CVE-2026-14214CWE-287

CVE-2026-14214

Low · published August 1, 2026

CVSS v3.1
2.7
EPSS
0%
Percentile
19.6
In the wild
Unconfirmed
What it is

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00281 · 19.6th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-08-01T11:16Z
References (1)
https://wpscan.com/vulnerability/4dd7bb63-e058-49d8-96ba-1fe38985e78e/ · [email protected]
EPSS history
Timeline
  • 01 AUG 06:00Z
    Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment
    cvelistv5