CVE-2026-14214

LowCVSS 2.7

Published: 01/08/2026(UTC)Updated: 05/08/2026(UTC)Translated: 01/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

The Booking for Appointments and Events Calendar WordPress plugin before version 2.4.4 does not restrict which fields can be written during customer import. A user with the Amelia Manager role can modify arbitrary columns of any stored user record by supplying them in the import request.

Risk Assessment

Risk of unauthorized modification of user data, including privilege escalation or data integrity compromise.

Recommendation

Update the Booking for Appointments and Events Calendar plugin to version 2.4.4 or later.

Original NVD description (English source)

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.