Medium severity · published Aug 26, 2026
CVE-2026-14216
Amelia < 2.4.7 - Unauthenticated Notification Queue Dispatch
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BF
Booking for Appointments and Events Calendar ·
before 2.4.7 · source: vendor
Affected product
BF
Booking for Appointments and Events Calendar
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-14216
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-14216
wpscan.com
https://wpscan.com/vulnerability/c38bf5b3-902c-4126-a9a3-42d9f2d359c3/
More from Booking for Appointments and Events Calendar
7.2
CVE-2026-77705
Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover
6.5
CVE-2026-14215
Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger
5.3
CVE-2026-77689
Amelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass
4.7
CVE-2026-14212
Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR
3.8
CVE-2026-14211
Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR