CVE-2026-14213

Amelia < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDOR

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.

Affected

Booking for Appointments and Events Calendar

CVSS v3.1 CNA

3.7 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.26% chance of exploitation in the next 30 days, 16th percentile

Published

2026-08-13

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/30015f96-2771-493e-96d7-9067996e1531/

References

• CVE Record
• NVD entry