Is CVE-2026-14326 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14326 being exploited in the wild.

How severe is CVE-2026-14326?

Low severity, with a CVSS score of 3.8, published 2 September 2026.

Which products and versions are affected?

Timetics Timetics through 1.0.61.

Is there a fix for CVE-2026-14326?

A patch was published on 2026-08-26: Fixed in version 1.0.62 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-14326 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-14326?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14326: Timetics WordPress plugin appointment modification via IDOR in REST API

CVE-2026-14326 · Severity: low · CVSS 3.8 · Published 2026-09-02

Timetics is a WordPress plugin that allows businesses to manage staff appointments and scheduling. The plugin fails to properly verify that staff members can only modify their own appointments, allowing any staff member to alter, disable, or take over appointments belonging to other staff members through its REST API.

Quick answers

Is CVE-2026-14326 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14326 being exploited in the wild.
How severe is CVE-2026-14326?: Low severity, with a CVSS score of 3.8, published 2 September 2026.
Which products and versions are affected?: Timetics Timetics through 1.0.61.
Is there a fix for CVE-2026-14326?: A patch was published on 2026-08-26: Fixed in version 1.0.62 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14326 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-14326?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an Insecure Direct Object Reference (IDOR) vulnerability in the Timetics REST API appointments endpoint. The vulnerable component is the PUT /wp-json/timetics/v1/appointments/{id} endpoint, which does not enforce per-object ownership checks when updating appointment records. An authenticated user with the custom timetics-staff role can modify any appointment ID by sending a REST request with their valid WordPress nonce, bypassing authorization controls. An attacker can modify appointment details (name, visibility, duration, capacity) and transfer ownership (author field) to themselves. The vulnerability is fixed in version 1.0.62; all versions through 1.0.61 are affected.

Affected products

Timetics Timetics through 1.0.61

Timeline

2026-08-26: disclosed
2026-08-26: patched: Fixed in version 1.0.62
2026-09-02: advisory
2026-09-21: other: Last updated in vulnerability database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.