CVE-2026-14216
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Booking for Appointments and Events Calendar WordPress plugin before version 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.
Risk Assessment
An unauthenticated attacker can send unwanted notifications or trigger integrations, potentially leading to abuse, spam, or system disruption.
Recommendation
Update the plugin to version 2.4.7 or later and implement authentication for notification queue processing.
Other vulnerabilities in Booking for Appointments and Events Calendar
See all- CVE-2026-77704Low risk· EPSS 3%
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment.
- CVE-2026-14212Medium
The Booking for Appointments and Events Calendar WordPress plugin before version 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated. This allows any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.
- CVE-2026-14213Low
The Booking for Appointments and Events Calendar WordPress plugin before version 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.
- CVE-2026-14214Low
The Booking for Appointments and Events Calendar WordPress plugin before version 2.4.4 does not restrict which fields can be written during customer import. A user with the Amelia Manager role can modify arbitrary columns of any stored user record by supplying them in the import request.
Original NVD description (English source)
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.