SEPTEMBER 18, 2026
Live Feed
Back to database
Case File

CVE-2026-14212

MEDIUM · CVSS 4.7 EPSS 0.28%

Source: NVD + CISA KEV + EPSS · Published 2026-08-26 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

The Booking for Appointments and Events Calendar plugin for WordPress prior to version 9.8 is vulnerable due to inadequate verification of account ownership, allowing authenticated employees to overwrite another employee's password. This could lead to unauthorized account access and potential data breaches. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.

CVE
CVE-2026-14212
Severity
MEDIUM
CVSS
4.7
EPSS
0.28%
WordPress

Original NVD Description

The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.