CVE-2026-14211: WordPress Booking Plugin Auth Bypass Flaw

CVE-2026-14211 Overview

CVE-2026-14211 affects the Booking for Appointments and Events Calendar WordPress plugin in versions before 9.7. The plugin fails to validate that an authenticated employee (provider) is associated with the customer record being accessed. Any employee holding an Employee Panel login can enumerate sequential customer identifiers to read and modify stored personal data belonging to customers outside their assignment. The flaw is an Insecure Direct Object Reference [CWE-639] and requires authenticated access with elevated (employee) privileges.

Critical Impact
Authenticated employees can horizontally access and modify personal data of any customer stored by the plugin by manipulating record identifiers.

Affected Products

Booking for Appointments and Events Calendar WordPress plugin versions prior to 9.7
WordPress sites exposing the plugin's Employee Panel to multiple providers
Deployments relying on the plugin to store customer personally identifiable information (PII)

Discovery Timeline

2026-08-10 - CVE-2026-14211 published to the National Vulnerability Database
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-14211

Vulnerability Analysis

The plugin exposes an Employee Panel that allows authenticated providers to review and edit customer records. The panel endpoints accept a customer record identifier as a request parameter and return or modify the corresponding record. The application authenticates the requesting employee but does not authorize the request against the ownership of the target record. As a result, an employee assigned to one customer can substitute an arbitrary identifier and access records belonging to customers of other providers.

Customer records handled by the plugin typically contain names, contact details, appointment history, and other booking-related personal data. The vulnerability enables both disclosure and modification, so an attacker with employee credentials can enumerate identifiers, harvest PII, or tamper with appointment data.

Root Cause

The root cause is missing authorization on record-level operations, classified as [CWE-639] Authorization Bypass Through User-Controlled Key. The plugin trusts the identifier supplied by the authenticated client and never checks whether the current employee has a legitimate relationship with the referenced customer.

Attack Vector

Exploitation requires a valid Employee Panel account and network access to the WordPress site. The attacker iterates sequential customer identifiers against the vulnerable endpoint and observes responses. No user interaction is required. Refer to the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-14211

Indicators of Compromise

Employee Panel HTTP requests referencing sequential or non-sequential customer identifiers outside the requesting provider's assigned records
High-volume GET or POST requests to plugin endpoints from a single authenticated employee session within a short time window
Unexpected modifications to customer records that do not correlate with a scheduled appointment for the acting employee

Detection Strategies

Correlate WordPress access logs with plugin database changes to identify employees viewing or editing records outside their assigned customer set
Instrument the plugin or a web application firewall to log the acting user identity alongside the target customer identifier on every request
Alert on identifier enumeration patterns, such as monotonically increasing customer IDs from one session

Monitoring Recommendations

Enable WordPress audit logging for customer record read and write events via a plugin such as WP Activity Log
Forward web server and audit logs to a centralized log platform and retain them long enough to investigate account misuse
Review Employee Panel account provisioning and deactivate stale or shared employee accounts

How to Mitigate CVE-2026-14211

Immediate Actions Required

Upgrade the Booking for Appointments and Events Calendar plugin to version 9.7 or later on all WordPress sites
Audit Employee Panel accounts and remove any that are no longer required, enforcing unique credentials per provider
Review recent customer record access and modification activity for evidence of enumeration or unauthorized changes

Patch Information

The vendor addressed the missing authorization check in version 9.7 of the plugin. Consult the WPScan Vulnerability Report for the fixed version reference and update guidance.

Workarounds

Restrict access to the Employee Panel by IP allowlist at the web server or WAF layer until the plugin is upgraded
Reduce the number of accounts with Employee Panel privileges to limit the population capable of exploiting the flaw
Deploy a WAF rule that blocks requests to plugin endpoints containing customer identifiers not tied to the authenticated session

bash

# Example: restrict Employee Panel path to trusted IPs in Nginx
location ~* /wp-content/plugins/booking-appointments/employee-panel/ {
    allow 203.0.113.0/24;
    deny all;
}