CVE-2026-14215
Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by enumerating its identifier.
| Vendor | unknown |
| Product | booking for appointments and events calendar |
| Published | Sep 2, 2026 |
| Last Updated | Sep 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown booking for appointments and events calendar
Be the first to know when new medium vulnerabilities affecting unknown booking for appointments and events calendar are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Booking for Appointments and Events Calendar
0 < 2.4.9
References
Credits
Haitam Lazaar WPScan