CVE-2026-14214lowCWE-287

CVE-2026-14214: low-severity vulnerability in Booking for Appointments and Events Calendar

Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment

Published · Updated

Follow this CVE+ Monitor Booking for Appointments and Events Calendar

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 2.7epss 0.3%
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · Booking for Appointments and Events Calendar
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Booking for Appointments and Events Calendar

In the same product, most dangerous first.

CVE-2026-77705HIGHAmelia < 2.4.10 - Amelia Manager+ WordPress Account TakeoverEPSS 0.5%CVE-2026-14215MEDIUMAmelia < 2.4.9 - Unauthenticated Post-Booking Action TriggerEPSS 0.4%CVE-2026-14216MEDIUMAmelia < 2.4.7 - Unauthenticated Notification Queue DispatchEPSS 0.4%CVE-2026-77689MEDIUMAmelia Pro 9.0 - 9.8 - Unauthenticated Payment BypassEPSS 0.3%CVE-2026-14212MEDIUMAmelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOREPSS 0.3%CVE-2026-77704LOWAmelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-ApprovalEPSS 0.3%