CVE-2026-14213

LowCVSS 3.7/10Last modified Aug 26, 2026

Description

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Aug 13, 2026
Last modified
Aug 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-142142.7The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its cuCVE-2026-142156.5The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token befCVE-2026-142166.5The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pendinCVE-2026-142195.4URL redirection to untrusted site ('open redirect') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human CVE-2026-14229.8A vulnerability was found in code-projects Online Examination System 1.0. Affected by this vulnerability is an unknown functionality of the CVE-2026-142213.8The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relyCVE-2026-142223.8The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actioCVE-2026-142234.3The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowiCVE-2026-142245.4The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belonCVE-2026-142252.7The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, cheCVE-2026-142264.3The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoiCVE-2026-142274.9An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulner
CVE-2026-14213: Low severity, CVSS 3.7 | Vulnix