{"id":"CVE-2026-14216","aliases":["EUVD-2026-66269","GHSA-hfw9-fm9r-jwrp"],"status":"published","title":"Amelia \u003c 2.4.7 - Unauthenticated Notification Queue Dispatch","description":"The Booking for Appointments and Events Calendar  WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00431,"percentile":0.37702,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2026-08-26T06:00:18Z","modified":"2026-09-03T12:58:58Z","products":[{"vendor":"unknown","product":"booking for appointments and events calendar"}],"references":[{"url":"https://wpscan.com/vulnerability/c38bf5b3-902c-4126-a9a3-42d9f2d359c3/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14216"},{"url":"https://wpscan.com/vulnerability/c38bf5b3-902c-4126-a9a3-42d9f2d359c3"},{"url":"https://github.com/advisories/GHSA-hfw9-fm9r-jwrp"}],"sources":{"cve":[{"id":"CVE-2026-14216","title":"Amelia \u003c 2.4.7 - Unauthenticated Notification Queue Dispatch","description":"The Booking for Appointments and Events Calendar  WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.","status":"published","published":"2026-08-26T06:00:18.648Z","modified":"2026-09-03T12:58:58.6Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T13:38:43.260938Z"}],"euvd":[{"id":"EUVD-2026-66269","description":"The Booking for Appointments and Events Calendar  WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.","status":"published","published":"2026-08-26T06:00:18Z","modified":"2026-09-03T12:58:58Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:01:14.198061Z"}],"ghsa":[{"id":"GHSA-hfw9-fm9r-jwrp","title":"The Booking for Appointments and Events Calendar  WordPress plugin before 2.4.7 does not require...","description":"The Booking for Appointments and Events Calendar  WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.","status":"published","published":"2026-08-26T18:31:52Z","modified":"2026-08-26T18:32:01Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:10:59.944342Z"}],"nvd":[{"id":"CVE-2026-14216","description":"The Booking for Appointments and Events Calendar  WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.","status":"published","published":"2026-08-26T06:16:24.91Z","modified":"2026-08-26T16:30:52.723Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:12:41.66469Z"}]}}