CVE-2026-14211
Received Received - Intake

Authentication Bypass in Booking Calendar WordPress Plugin

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: WPScan

Description
The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any customer by enumerating sequential identifiers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-14211
EUVD
EUVD-2026-55003

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_plugin booking_for_appointments_and_events_calendar to 9.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the Booking for Appointments and Events Calendar WordPress plugin before version 9.7. It allows authenticated employees with access to the Employee Panel to read or modify any customer's personal data by guessing sequential customer IDs without proper authorization.

Detection Guidance

Check WordPress plugin versions for 'Booking for Appointments and Events Calendar' plugin. If version is below 9.7, the system is vulnerable. Review access logs for unauthorized data access attempts or modifications by employees.

Impact Analysis

If you are a customer using this plugin, your personal data could be accessed or altered by unauthorized employees. If you are a business using the plugin, this could lead to data breaches, loss of customer trust, and potential legal consequences.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA as it allows unauthorized access to personal data. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. A breach could result in fines or penalties.

Mitigation Strategies

Update the 'Booking for Appointments and Events Calendar' plugin to version 9.7 or later immediately. Restrict employee panel access to only necessary personnel and review permissions to ensure proper authorization checks are in place.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14211. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart