CVE-2026-14211
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Booking for Appointments and Events Calendar WordPress plugin before version 9.7 does not verify that an authenticated employee (provider) is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any customer by enumerating sequential identifiers.
Risk Assessment
Employees could access customers' personal data, violating privacy and potentially leading to sensitive data leakage.
Recommendation
Update the Booking for Appointments and Events Calendar plugin to version 9.7 or later, which includes access control fixes.
Original NVD description (English source)
The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any customer by enumerating sequential identifiers.