CVE-2026-1228 is an insecure direct object reference vulnerability in the Timeline Block – Beautiful Timeline Builder for WordPress plugin (up to version 1.3.3). The vulnerability arises from the tlgb_shortcode() function failing to validate the user-supplied id attribute in the timeline_block shortcode. This allows authenticated users with Author-level privileges or higher to bypass authorization controls and disclose private timeline content. The issue is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low complexity, required privileges at the Author level, no user interaction, and limited confidentiality impact.

Authenticated users with Author-level or higher privileges can access private timeline content that should be restricted, potentially exposing sensitive information. There is no impact on integrity or availability reported. The vulnerability does not allow unauthenticated access or privilege escalation beyond the Author role.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access carefully and consider disabling or limiting use of the Timeline Block plugin if private timeline confidentiality is critical. Monitor vendor channels for updates or patches addressing this issue.