Timetics CVE-2026-14326

Exploitation requires a WordPress account assigned the Timetics plugin's custom 'staff' role on the target site, running Timetics version 1.0.61 or earlier with the plugin active. The attacker must also identify appointment IDs belonging to other staff members, which may be discoverable through the same REST API. No special network position, exploit toolkit, or non-default server configuration is required beyond the staff account itself. Standard WordPress roles (subscriber, contributor, editor) without the custom staff role cannot exploit this vulnerability, as can administrators who already have full privileges.

The CVSS base score of 3.8 (Low) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L is a reasonable reflection of the limited blast radius: no confidentiality exposure, only low-severity integrity and availability effects, and a hard prerequisite of holding the plugin's staff-role account. The publicly available WPScan PoC raises practical risk for sites where staff accounts are granted to potentially untrustworthy users - a scheduling-heavy organization managing many staff accounts should audit who holds that role - but the PR:H requirement keeps this well below the threshold of remotely exploitable issues with no authentication barrier. EPSS data is absent from the input, preventing quantitative exploitation-probability assessment. The vulnerability is not listed in CISA KEV, and no reports of active exploitation have been identified. This ranks as a low-priority authorization hygiene issue rather than an urgent remediation target.

An attacker who holds a valid staff-role account on a Timetics-powered WordPress site uses the REST API to enumerate appointment IDs belonging to other staff members, then sends a crafted update request targeting those IDs. Because the server performs no ownership check, the attacker can overwrite appointment details, cancel them, or reassign them. The public WPScan PoC confirms the attack requires only a valid session token and knowledge of a target appointment ID.