CVE-2026-19966

The CVSS 5.4 score on this IDOR warrants scrutiny, but not for the reason you might expect. This isn't a scoring failure—it's a scoring that reflects the narrow technical window the metrics capture. The vulnerability is an insecure direct object reference in the contact update endpoint, where an authenticated user can manipulate the contact_id parameter to modify records they don't own. The 5.4 reflects that authentication is still required—the attacker needs valid session credentials. What it doesn't capture is the downstream cascade. This plugin is a TimeCamp CRM integration. Contact records modified through this endpoint aren't isolated—they feed directly into billing systems, project assignment logic, and potentially payroll integrations that treat this data as authoritative. That's the blast radius the CVSS vector completely misses. An IDOR here isn't just

Reviewed through automated stages and approved by a human before publication.