CVE-2026-14216 in Booking for Appointments and Events Calendar Plugin

Sumário

de MITRE • 26/08/2026

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• Responsável: WPScan
• Reservar: 30/06/2026
• Divulgação: 26/08/2026
• Moderação: aceite
• Entrada: VDB-395678
• CPE: pronto
• CWE: CWE-287 (confirmado)
• CVSS: 7.3 (VulDB)
• EPSS: 0.00000
• KEV: não
• Atividades: muito baixo
• Sector: Hostingprovider

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-14216
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-14216
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-14216/