CVE-2026-14211 Booking for Appointments and Events Calendar CVE debrief

Who should care

Organizations using the Booking for Appointments and Events Calendar WordPress plugin, particularly those with multiple employees accessing customer data, should be aware of this vulnerability. The issue affects operators of the plugin, platform administrators, vulnerability management teams, and security teams responsible for protecting customer data. Defenders should review the plugin's access controls, customer record permissions, and implement compensating controls if necessary.

Technical summary

The Booking for Appointments and Events Calendar WordPress plugin before version 9.7 lacks access controls, allowing any employee with an Employee Panel login to read and modify customer personal data by enumerating sequential identifiers. This vulnerability affects organizations using the plugin, especially those with multiple employees. To address this, defenders should verify employee access controls, restrict access to customer records based on employee relationships, and monitor for suspicious activity.

Defensive priority

Organizations using the Booking for Appointments and Events Calendar WordPress plugin should verify employee access controls.

Recommended defensive actions

• Verify employee access controls for the Booking for Appointments and Events Calendar WordPress plugin
• Restrict access to customer records based on employee relationships
• Monitor for suspicious activity related to customer data access
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE description indicates that the Booking for Appointments and Events Calendar WordPress plugin before version 9.7 does not verify authenticated employee relationships to accessed customer records, allowing unauthorized data access. This issue affects organizations using the plugin, particularly those with multiple employees accessing customer data. To verify, defenders should review employee access controls, customer record permissions, and monitor for suspicious activity related to customer data access.

Official resources