CVE-2026-14216CWE-287

CVE-2026-14216

Medium · published August 26, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
22.1
In the wild
Unconfirmed
What it is

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00305 · 22.1th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-08-26T10:16Z
References (1)
https://wpscan.com/vulnerability/c38bf5b3-902c-4126-a9a3-42d9f2d359c3/ · [email protected]
EPSS history
Timeline
  • 27 AUG 06:18Z
    EPSS moved — → 0%
    epss
  • 26 AUG 06:00Z
    Amelia < 2.4.7 - Unauthenticated Notification Queue Dispatch
    cvelistv5