Medium severity · published Aug 26, 2026
CVE-2026-14212
Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR
4.7
CVSS
0.3%
EPSS
No
On KEV
Description
The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BF
Booking for Appointments and Events Calendar ·
9.0 before 9.8 · source: vendor
Affected product
BF
Booking for Appointments and Events Calendar
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-14212
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-14212
wpscan.com
https://wpscan.com/vulnerability/5afb51cc-8e1e-4c3c-aba6-6789e89161ae/
More from Booking for Appointments and Events Calendar
7.2
CVE-2026-77705
Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover
6.5
CVE-2026-14215
Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger
6.5
CVE-2026-14216
Amelia < 2.4.7 - Unauthenticated Notification Queue Dispatch
5.3
CVE-2026-77689
Amelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass
3.8
CVE-2026-14211
Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR