CVE-2026-14213
Received Received - Intake

Unauthorized Appointment Data Exposure in Booking Calendar Plugin

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: WPScan

Description
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-14213
EUVD
EUVD-2026-57727

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the Amelia WordPress plugin before version 2.4.6. It allows any authenticated employee (provider) to access and read appointment details, including personal data of customers, by manipulating appointment identifiers without proper authorization checks.

Detection Guidance

To detect this vulnerability, check if your Amelia WordPress plugin version is prior to 2.4.6. Log in as an authenticated employee and attempt to access appointment details by manipulating appointment IDs. If unauthorized access to personal data is possible, the system is vulnerable.

Impact Analysis

An attacker with access to the system could exploit this flaw to view sensitive customer information such as names, contact details, or other personal data associated with appointments. This could lead to privacy breaches and potential misuse of the disclosed data.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA as it allows unauthorized access to personal data. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update the Amelia WordPress plugin to version 2.4.6 or later. Ensure proper authorization checks are enforced for appointment access. Monitor for unauthorized access attempts and review logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14213. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart