CVE-2026-14214
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Booking for Appointments and Events Calendar WordPress plugin before version 2.4.4 does not restrict which fields can be written during customer import. A user with the Amelia Manager role can modify arbitrary columns of any stored user record by supplying them in the import request.
Risk Assessment
Risk of unauthorized modification of user data, including privilege escalation or data integrity compromise.
Recommendation
Update the Booking for Appointments and Events Calendar plugin to version 2.4.4 or later.
Original NVD description (English source)
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.