CVE-2026-14213

Deferred Deferred - Pending Action

Unauthorized Appointment Data Exposure in Booking Calendar Plugin

Publication date: 2026-08-13

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-26

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-09-01

NVD

CVE-2026-14213

EUVD

EUVD-2026-57727

Affected Vendors & Products

Vendor	Product	Version / Range
amelia	amelia	to 2.4.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the Amelia WordPress plugin before version 2.4.6. It allows any authenticated employee (provider) to access and read appointment details, including personal data of customers, by manipulating appointment identifiers without proper authorization checks.

Detection Guidance

To detect this vulnerability, check if your Amelia WordPress plugin version is prior to 2.4.6. Log in as an authenticated employee and attempt to access appointment details by manipulating appointment IDs. If unauthorized access to personal data is possible, the system is vulnerable.

Impact Analysis

An attacker with access to the system could exploit this flaw to view sensitive customer information such as names, contact details, or other personal data associated with appointments. This could lead to privacy breaches and potential misuse of the disclosed data.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA as it allows unauthorized access to personal data. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update the Amelia WordPress plugin to version 2.4.6 or later. Ensure proper authorization checks are enforced for appointment access. Monitor for unauthorized access attempts and review logs for suspicious activity.

Hi! I’m here to help you understand CVE-2026-14213. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70