CVE-2026-1228

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-1228
The Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.3 via the tlgb_shortcode() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to disclose private timeline content via the id attribute supplied to the 'timeline_block' shortcode.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/changeset/3446078/timeline-block-block
https://www.wordfence.com/threat-intel/vulnerabilities/id/cecebfd0-c2af-4150-8793-299cdbeaa7b9?source=cve
Configurations

No configuration.

History

15 Apr 2026, 00:35

Type Values Removed Values Added
Summary
  • (es) El plugin Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) para WordPress es vulnerable a Referencia Directa Insegura a Objeto en todas las versiones hasta la 1.3.3, inclusive, a través de la función tlgb_shortcode() debido a la falta de validación en una clave controlada por el usuario. Esto permite a atacantes autenticados, con acceso de nivel Autor y superior, divulgar contenido privado de la línea de tiempo a través del atributo id suministrado al shortcode 'timeline_block'.

06 Feb 2026, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-06 03:15

Updated : 2026-04-15 00:35

NVD link : CVE-2026-1228

Mitre link : CVE-2026-1228

CVE.ORG link : CVE-2026-1228

JSON object : View

Products Affected

No product.

CWE
CWE-639

Authorization Bypass Through User-Controlled Key