CVE-2026-14214

LowCVSS 2.7/10Last modified Aug 26, 2026

Description

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Aug 1, 2026
Last modified
Aug 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-142156.5The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token befCVE-2026-142166.5The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pendinCVE-2026-142195.4URL redirection to untrusted site ('open redirect') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human CVE-2026-14229.8A vulnerability was found in code-projects Online Examination System 1.0. Affected by this vulnerability is an unknown functionality of the CVE-2026-142213.8The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relyCVE-2026-142223.8The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actioCVE-2026-142234.3The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowiCVE-2026-142245.4The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belonCVE-2026-142252.7The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, cheCVE-2026-142264.3The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoiCVE-2026-142274.9An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerCVE-2026-142295.3The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested throu
CVE-2026-14214: Low severity, CVSS 2.7 | Vulnix