{"id":"CVE-2026-14216","state":"PUBLISHED","title":"Amelia < 2.4.7 - Unauthenticated Notification Queue Dispatch","description":"The Booking for Appointments and Events Calendar  WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.","publishedAt":"2026-08-26T06:00:18.648Z","updatedAt":"2026-09-03T12:58:58.600Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown Booking for Appointments and Events Calendar"],"affected":[{"vendor":"Unknown","product":"Booking for Appointments and Events Calendar","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.4.7","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/c38bf5b3-902c-4126-a9a3-42d9f2d359c3/"],"weaknesses":["CWE-287"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/14xxx/CVE-2026-14216.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-14216","state":"PUBLISHED","datePublished":"2026-08-26T06:00:18.648Z","dateUpdated":"2026-09-03T12:58:58.600Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2026-06-30T11:19:43.864Z"},"containers":{"cna":{"title":"Amelia < 2.4.7 - Unauthenticated Notification Queue Dispatch","descriptions":[{"lang":"en","value":"The Booking for Appointments and Events Calendar  WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks."}],"affected":[{"vendor":"Unknown","product":"Booking for Appointments and Events Calendar","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.4.7","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/c38bf5b3-902c-4126-a9a3-42d9f2d359c3/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-287 Improper Authentication","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2026-08-26T06:00:18.648Z"},"credits":[{"lang":"en","value":"Manuel Martínez Casasola","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-08-26T14:35:30.534181Z","id":"CVE-2026-14216","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","type":"CWE","lang":"en","description":"CWE-287 Improper Authentication"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-03T12:58:58.600Z"}}]}}}