CVE-2026-14212CWE-639

CVE-2026-14212

Medium · published August 26, 2026

CVSS v3.1
4.7
EPSS
0%
Percentile
9.8
In the wild
Unconfirmed
What it is

The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00204 · 9.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-08-26T10:16Z
References (1)
https://wpscan.com/vulnerability/5afb51cc-8e1e-4c3c-aba6-6789e89161ae/ · [email protected]
EPSS history
Timeline
  • 27 AUG 06:18Z
    EPSS moved — → 0%
    epss
  • 26 AUG 06:00Z
    Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR
    cvelistv5