CVE-2026-14212
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Booking for Appointments and Events Calendar WordPress plugin before version 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated. This allows any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.
Risk Assessment
The risk includes employee account takeover, potentially leading to unauthorized access to data, schedule manipulation, or other harm. Attackers could also use compromised accounts for further attacks.
Recommendation
Update the Booking for Appointments and Events Calendar plugin to version 9.8 or later. Also immediately check for unauthorized password changes and consider forcing password resets for all employees.
Other vulnerabilities in Booking for Appointments and Events Calendar
See all- CVE-2026-77704Low risk· EPSS 3%
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment.
- CVE-2026-14216Medium
The Booking for Appointments and Events Calendar WordPress plugin before version 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.
- CVE-2026-14213Low
The Booking for Appointments and Events Calendar WordPress plugin before version 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.
- CVE-2026-14214Low
The Booking for Appointments and Events Calendar WordPress plugin before version 2.4.4 does not restrict which fields can be written during customer import. A user with the Amelia Manager role can modify arbitrary columns of any stored user record by supplying them in the import request.
Original NVD description (English source)
The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.