CVE-2026-14326: CWE-639 Authorization Bypass Through User-Controlled Key in Timetics

CVE-2026-14326 describes an authorization bypass vulnerability (CWE-639) in the Timetics WordPress plugin through version 1.0.61. The plugin fails to enforce per-object ownership validation when updating appointments via its REST API. As a result, users assigned the custom staff role can modify, disable, or take over appointments that belong to other staff members. The vulnerability has a CVSS 3.1 base score of 3.8, indicating low severity, with network attack vector, low attack complexity, and requiring high privileges. There is no indication of a vendor patch or official remediation at this time.

The vulnerability allows users with the custom staff role to alter appointments of other staff members, potentially disrupting scheduling and availability. There is no impact on confidentiality, but integrity and availability of appointment data can be compromised. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict assignment of the custom staff role to trusted users only and monitor for unauthorized appointment modifications.