Insecure Direct Object Reference in Beautiful Timeline Builder for WordPress

CVE-2026-1228

What is CVE-2026-1228?

The Beautiful Timeline Builder plugin for WordPress has a vulnerability that allows authenticated users with Author-level access and higher to exploit the tlgb_shortcode() function. This issue arises from a lack of validation on a key that is user-controlled, potentially enabling these users to access private timeline content by manipulating the id attribute of the 'timeline_block' shortcode. As a result, sensitive information may be disclosed, impacting user privacy.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References