CVE-2026-14212

MediumCVSS 4.7/10Last modified Aug 26, 2026

Description

The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Aug 26, 2026
Last modified
Aug 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-142133.7The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) isCVE-2026-142142.7The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its cuCVE-2026-142156.5The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token befCVE-2026-142166.5The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pendinCVE-2026-142195.4URL redirection to untrusted site ('open redirect') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human CVE-2026-14229.8A vulnerability was found in code-projects Online Examination System 1.0. Affected by this vulnerability is an unknown functionality of the CVE-2026-142213.8The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relyCVE-2026-142223.8The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actioCVE-2026-142234.3The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowiCVE-2026-142245.4The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belonCVE-2026-142252.7The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, cheCVE-2026-142264.3The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoi
CVE-2026-14212: Medium severity, CVSS 4.7 | Vulnix