Description
The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members.
Published: 2026-09-02
Score: 3.8 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Timetics plugin for WordPress fails to enforce per-object ownership when appointments are updated through its REST API. Users with the custom staff role can modify, disable, or take over appointments that belong to other staff members, compromising the integrity and availability of appointment data.

Affected Systems

The vulnerability affects Timetics WordPress plugin versions 1.0.61 and earlier. No other vendors or product versions are listed.

Risk and Exploitability

The CVSS score of 3.8 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves authenticated staff users sending crafted REST API requests to modify appointments belonging to other staff members. No additional prerequisites beyond possessing the staff role are stated in the description.

Generated by OpenCVE AI on September 3, 2026 at 11:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Timetics plugin to version 1.0.62 or later where the IDOR flaw is corrected.
  • Revoke or reduce permissions for the custom staff role to limit its ability to modify appointments.
  • Audit WordPress REST API logs for anomalous appointment modifications and investigate any unauthorized changes.

Generated by OpenCVE AI on September 3, 2026 at 11:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Timetics
Timetics timetics
Wordpress
Wordpress wordpress
Vendors & Products Timetics
Timetics timetics
Wordpress
Wordpress wordpress

Wed, 02 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Description The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members.
Title Timetics <= 1.0.61 - Staff+ Cross-Staff Appointment Modification via IDOR
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 3.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Timetics Timetics
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-09-02T14:57:38.546Z

Reserved: 2026-07-01T12:16:09.144Z

Link: CVE-2026-14326

cve-icon Vulnrichment

Updated: 2026-09-02T14:41:42.830Z

cve-icon NVD

Status : Deferred

Published: 2026-09-02T15:17:37.553

Modified: 2026-09-03T17:50:37.690

Link: CVE-2026-14326

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T14:15:06Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key