CVE-2026-14214
Received Received - Intake

Privilege Escalation in Booking for Appointments and Events Calendar Plugin

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: WPScan

Description
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-14214
EUVD
EUVD-2026-51705

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
amelia booking_for_appointments_and_events_calendar to 2.4.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Amelia WordPress plugin before version 2.4.4. It allows a user with the Amelia Manager role to modify any stored user record by importing a file that includes arbitrary columns. The plugin does not restrict which fields can be updated during the import process.

Impact Analysis

If you use the affected plugin, an attacker with the Amelia Manager role could alter user data, potentially leading to unauthorized changes in user accounts, data corruption, or loss of data integrity. This could affect business operations and user trust.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by allowing unauthorized modifications to user data. GDPR requires data integrity and security, while HIPAA mandates protection of health information. Unauthorized changes could violate these requirements.

Mitigation Strategies

Update the Booking for Appointments and Events Calendar WordPress plugin to version 2.4.4 or later to address the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14214. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart