CVE-2026-14216

MediumCVSS 6.5/10Last modified Aug 26, 2026

Description

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Aug 26, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-142195.4URL redirection to untrusted site ('open redirect') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human CVE-2026-14229.8A vulnerability was found in code-projects Online Examination System 1.0. Affected by this vulnerability is an unknown functionality of the CVE-2026-142213.8The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, rely CVE-2026-142223.8The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actio CVE-2026-142234.3The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowi CVE-2026-142245.4The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belon CVE-2026-142252.7The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, che CVE-2026-142264.3The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoi CVE-2026-142274.9An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulner CVE-2026-142295.3The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested throu CVE-2026-14239.8A vulnerability was determined in code-projects Online Examination System 1.0. Affected by this issue is some unknown functionality of the f CVE-2026-142305.4The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated o