CVE-2026-14212mediumCWE-639

CVE-2026-14212: medium-severity vulnerability in Booking for Appointments and Events Calendar

Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR

Published

Follow this CVE+ Monitor Booking for Appointments and Events Calendar

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 4.7epss 0.3%
The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Affected products
Unknown · Booking for Appointments and Events Calendar
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Booking for Appointments and Events Calendar

In the same product, most dangerous first.

CVE-2026-77705HIGHAmelia < 2.4.10 - Amelia Manager+ WordPress Account TakeoverEPSS 0.5%CVE-2026-14215MEDIUMAmelia < 2.4.9 - Unauthenticated Post-Booking Action TriggerEPSS 0.4%CVE-2026-14216MEDIUMAmelia < 2.4.7 - Unauthenticated Notification Queue DispatchEPSS 0.4%CVE-2026-77689MEDIUMAmelia Pro 9.0 - 9.8 - Unauthenticated Payment BypassEPSS 0.3%CVE-2026-77704LOWAmelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-ApprovalEPSS 0.3%CVE-2026-14214LOWAmelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass AssignmentEPSS 0.3%