Vulnerability · Published Aug 1, 2026 · Assigned by WPScan
CVE-2026-14214Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment
Low 2.7
In plain English
A low-severity improper authentication in Booking for Appointments and Events Calendar from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)2.7Low
Exploit odds (30 days)0.3%top 79.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Booking for Appointments and Events Calendar | 0 – before 2.4.4 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/4dd7bb63-e058-49d8-96ba-1fe38985e78e/ exploit, vdb-entry, technical-description