CVE-2026-1228: Timeline Block WordPress IDOR Vulnerability

CVE-2026-1228 Overview

CVE-2026-1228 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the Timeline Block – Beautiful Timeline Builder for WordPress plugin. The vulnerability exists in all versions up to and including 1.3.3 and stems from the tlgb_shortcode() function, which fails to properly validate user-controlled input. This flaw allows authenticated attackers with Author-level access or above to access and disclose private timeline content that should otherwise be restricted.

Critical Impact

Authenticated attackers can exploit the missing validation on the id attribute of the timeline_block shortcode to access private timeline content, potentially exposing sensitive information intended to remain confidential.

Affected Products

• Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) plugin versions ≤ 1.3.3
• WordPress installations utilizing the vulnerable Timeline Block plugin
• Sites with Author-level or higher user accounts

Discovery Timeline

• 2026-02-06 - CVE CVE-2026-1228 published to NVD
• 2026-02-06 - Last updated in NVD database

Technical Details for CVE-2026-1228

Vulnerability Analysis

This vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), a common weakness pattern in web applications where access control decisions rely on user-supplied identifiers without proper validation.

The Timeline Block plugin provides WordPress shortcode functionality via the tlgb_shortcode() function, allowing users to embed timelines into posts and pages. The vulnerability arises because the function accepts an id attribute that directly references timeline posts without verifying whether the requesting user has authorization to view the specified content.

When a malicious user with Author-level privileges crafts a shortcode with an arbitrary timeline ID, the plugin retrieves and renders the timeline content regardless of its visibility status (published, private, or draft). This behavior bypasses WordPress's built-in access control mechanisms for private content.

Root Cause

The root cause of this vulnerability lies in the absence of authorization checks within the tlgb_shortcode() function. When processing the shortcode, the plugin directly queries the database for the timeline specified by the user-controlled id parameter without validating whether the current user has sufficient permissions to access that particular resource.

This represents a classic IDOR pattern where the application trusts client-supplied identifiers and fails to enforce object-level access control. The function should verify that the requested timeline's post status and visibility settings are compatible with the requesting user's permissions before returning the content.

Attack Vector

The attack vector for CVE-2026-1228 requires network access and authenticated access to a WordPress site with at least Author-level privileges. An attacker can exploit this vulnerability through the following mechanism:

The attacker, having Author-level credentials, creates or edits a post and inserts a timeline_block shortcode with the id attribute set to the identifier of a private timeline they wish to access. When the page containing this shortcode is previewed or published, the plugin processes the shortcode and retrieves the private timeline content, effectively bypassing access restrictions.

This exploitation path does not require user interaction from the victim and can be performed entirely through the WordPress post editor interface. The attacker can enumerate timeline IDs to discover and access multiple private timelines systematically.

Detection Methods for CVE-2026-1228

Indicators of Compromise

• Unusual shortcode patterns in posts or pages containing timeline_block shortcodes with sequential or enumerated id values
• Author-level users accessing or creating content that references timeline IDs they did not create
• Unexpected access patterns to private timeline content in server access logs
• Post edit history showing modifications to shortcode attributes by users other than timeline owners

Detection Strategies

• Review WordPress post content for timeline_block shortcodes referencing timelines created by other users
• Monitor plugin activity logs for shortcode rendering requests involving private post types
• Implement file integrity monitoring on Timeline Block plugin files to detect unauthorized modifications
• Deploy web application firewall rules to detect shortcode enumeration attempts

Monitoring Recommendations

• Enable detailed WordPress activity logging to track shortcode usage across user accounts
• Configure alerts for Author-level users accessing administrative timeline features
• Monitor for bulk content creation containing shortcode patterns indicative of enumeration attacks
• Review timeline access patterns periodically to identify unauthorized disclosures

How to Mitigate CVE-2026-1228

Immediate Actions Required

• Update the Timeline Block plugin to the latest patched version immediately
• Audit existing posts and pages for potentially exploited shortcodes referencing unauthorized timeline IDs
• Review user accounts with Author-level access and above for suspicious activity
• Consider temporarily disabling the Timeline Block plugin until the update can be applied

Patch Information

The vulnerability has been addressed in a plugin update. The fix can be reviewed in the WordPress Changeset Update. Site administrators should update to the latest version of the Timeline Block plugin through the WordPress plugin update mechanism. Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

• Restrict Author-level access to trusted users only until the plugin can be updated
• Remove or deactivate the Timeline Block plugin on sites where it is not essential
• Implement additional access control plugins to monitor and restrict shortcode usage
• Manually audit and remove any unauthorized shortcode references in existing content

# Configuration example
# Temporarily disable the Timeline Block plugin via WP-CLI
wp plugin deactivate timeline-block-block

# Update the plugin to the latest patched version
wp plugin update timeline-block-block

# Verify the plugin version after update
wp plugin get timeline-block-block --field=version