CVE-2026-14216
Amelia < 2.4.7 - Unauthenticated Notification Queue Dispatch
- State
- Published
- Severity
- 6.5 Medium
- Published
- Aug 26, 2026
- Updated
- Sep 3, 2026
- Reserved
- Jun 30, 2026
Description
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L | CISA-ADP |
Weaknesses
- CWE-287 Improper Authentication
Affected Products
| Product | Versions |
|---|---|
Booking for Appointments and Events CalendarUnknown |
|
References
- https://wpscan.com/vulnerability/c38bf5b3-902c-4126-a9a3-42d9f2d359c3/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.