Unauthorized Access in Booking for Appointments and Events Calendar Plugin
CVE-2026-14213

Currently unrated

Key Information:

Vendor

WordPress
Status
Booking For Appointments And Events Calendar
Vendor
CVE Published:
13 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-14213?

A significant access control vulnerability exists in the Booking for Appointments and Events Calendar plugin for WordPress prior to version 2.4.6. This flaw allows any authenticated employee to retrieve information about appointments without proper authorization, potentially exposing sensitive customer personal data. It compromises the integrity of the system by allowing unauthorized viewing of appointments through their identifiers, thus mandating urgent attention to update the plugin and mitigate risks.

Affected Version(s)

Booking for Appointments and Events Calendar 0 < 2.4.6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-14213 - Proof of Concept

References

https://wpscan.com/vulnerability/30015f96-2771-493e-96d7-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muni Nitish Kumar Yaddala
WPScan
.