CVE-2026-14215
Received Received - Intake

Unauthenticated Booking Notifications in Appointments Calendar

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: WPScan

Description
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by enumerating its identifier.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-14215
EUVD
EUVD-2026-69869

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpdevart booking_for_appointments_and_events_calendar to 2.4.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Booking for Appointments and Events Calendar WordPress plugin before version 2.4.9. It allows an unauthenticated user to trigger booking notifications and integration callbacks by guessing a booking identifier without authentication or a valid request token.

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the Booking for Appointments and Events Calendar plugin version before 2.4.9. Verify the plugin version in the WordPress admin panel under Plugins. If the version is outdated, the system is vulnerable.

Impact Analysis

An attacker could exploit this to send unauthorized booking notifications or trigger integration callbacks, potentially leading to data leaks or unauthorized actions. The vulnerability enables actions without proper authorization, posing risks to data integrity and confidentiality.

Compliance Impact

This vulnerability could lead to unauthorized access or actions on booking data, violating GDPR's data protection principles or HIPAA's access control requirements. Non-compliance risks include fines and legal penalties due to unauthorized data exposure or processing.

Mitigation Strategies

Immediately update the Booking for Appointments and Events Calendar plugin to version 2.4.9 or later. If updating is not possible, consider disabling the plugin until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14215. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart