Low severity · published Aug 13, 2026
CVE-2026-14213
Amelia < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDOR
3.7
CVSS
0.3%
EPSS
No
On KEV
Description
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BF
Booking for Appointments and Events Calendar ·
before 2.4.6 · source: vendor
Affected product
BF
Booking for Appointments and Events Calendar
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-14213
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-14213
wpscan.com
https://wpscan.com/vulnerability/30015f96-2771-493e-96d7-9067996e1531/
More from Booking for Appointments and Events Calendar
7.2
CVE-2026-77705
Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover
6.5
CVE-2026-14215
Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger
6.5
CVE-2026-14216
Amelia < 2.4.7 - Unauthenticated Notification Queue Dispatch
5.3
CVE-2026-77689
Amelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass
4.7
CVE-2026-14212
Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR