CVE-2026-14216

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.

Score

CVSS 3.1 6.5 Medium

Status

Deferred - contact@wpscan.com

Published

2026-08-26

Last modified

2026-09-03

Weaknesses

CWE-287

Affected products

• Booking For Appointments And Events Calendar (Unknown)

References

• https://wpscan.com/vulnerability/c38bf5b3-902c-4126-a9a3-42d9f2d359c3/