CVE-2026-14326

The Timetics WordPress plugin through 1.0.61 fails to enforce per-object ownership when updating appointments via its REST API . This allows users holding the plugin's custom staff role to modify, disable, or take over appointments belonging to other staff members. The vulnerability is classified...