CVE-2026-14215

MediumCVSS 6.5/10Last modified Sep 3, 2026

Description

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by enumerating its identifier.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Sep 2, 2026
Last modified: Sep 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-142166.5The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pendin CVE-2026-142195.4URL redirection to untrusted site ('open redirect') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human CVE-2026-14229.8A vulnerability was found in code-projects Online Examination System 1.0. Affected by this vulnerability is an unknown functionality of the CVE-2026-142213.8The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, rely CVE-2026-142223.8The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actio CVE-2026-142234.3The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowi CVE-2026-142245.4The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belon CVE-2026-142252.7The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, che CVE-2026-142264.3The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoi CVE-2026-142274.9An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulner CVE-2026-142295.3The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested throu CVE-2026-14239.8A vulnerability was determined in code-projects Online Examination System 1.0. Affected by this issue is some unknown functionality of the f