CVE-2026-14326

The Timetics WordPress plugin, up to version 1.0.61, is vulnerable due to a lack of per-object ownership enforcement in its REST API, enabling users with custom staff roles to alter or take control of appointments assigned to other staff members. This could lead to unauthorized modifications and potential data breaches within appointment management. WordPress site administrators using this plugin should prioritize applying updates or implementing access controls to mitigate the risk.