CVE-2026-14214: unknown booking for appointments and events calendar Improper Authentication
Vulnerability summary
CVE-2026-14214 is a medium (CVSS 4.3) Improper Authentication vulnerability in unknown booking for appointments and events calendar. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 19.2% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 2.4.4.
Timeline
- 01-08-2026PublishedVulnerability first disclosed.
- 05-08-2026Last modifiedVulnerability information updated.
Description
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA2.7LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:NDiffers
- NVDNIST2.7LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:NDiffers
EPSS trend
Probability
0.28%
Chance of exploitation in the next 30 days
Percentile
19%
Versus all other CVEs
30-day change
+0.12 pp
From 0.16% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Unknown1 product
Wordpress1 product
- ameliabooking< 2.4.4
2 vendors · 2 products