CVE-2026-14214

UNKNOWN 0.0

Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.

Vendor	unknown
Product	booking for appointments and events calendar
Published	Aug 1, 2026

Stay Ahead of the Next One

Get instant alerts for unknown booking for appointments and events calendar

Be the first to know when new unknown vulnerabilities affecting unknown booking for appointments and events calendar are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / Booking for Appointments and Events Calendar

0 < 2.4.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/4dd7bb63-e058-49d8-96ba-1fe38985e78e/

Credits

Manuel Martínez Casasola WPScan