CVE-2026-14214 Overview
CVE-2026-14214 affects the Booking for Appointments and Events Calendar WordPress plugin (Amelia) in versions before 2.4.4. The plugin does not restrict which fields can be written through its customer import functionality. A user holding the Amelia Manager role can modify arbitrary columns of any stored user record by supplying those fields in the import request. The issue is categorized under [CWE-287] (Improper Authentication) and enables limited integrity impact on WordPress user data.
Critical Impact
An authenticated Amelia Manager can alter arbitrary fields on any WordPress user record, including records outside the plugin's intended scope, through the customer import endpoint.
Affected Products
- Booking for Appointments and Events Calendar (Amelia) WordPress plugin
- All versions prior to 2.4.4
- WordPress installations using the Amelia Manager role
Discovery Timeline
- 2026-08-01 - CVE-2026-14214 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-14214
Vulnerability Analysis
The Amelia plugin exposes a customer import feature intended to bulk-create or update customer records. The import handler accepts a set of field-value pairs from the request and writes them to the underlying user table without maintaining an allowlist of permitted columns. As a result, a caller authenticated with the Amelia Manager role can include additional columns in the import payload and overwrite them on any existing WordPress user record. This crosses the boundary between the plugin's customer scope and the wider WordPress user store. The consequence is limited-integrity tampering of stored user records, without direct confidentiality or availability impact.
Root Cause
The root cause is missing field-level authorization in the customer import routine. The plugin trusts the requesting Manager to only submit customer-relevant fields and does not filter or validate the column names against an allowlist before writing to the database. Combined with the elevated privileges of the Amelia Manager role, this produces a broken access control condition mapped to [CWE-287].
Attack Vector
Exploitation requires an authenticated account with the Amelia Manager role. The attacker submits a crafted customer import request that includes non-customer fields such as user metadata, contact fields, or other columns on the user record. The import handler writes those values to the target record. No user interaction outside the attacker is required, and the request is delivered over the network to the WordPress admin endpoint. Refer to the WPScan Vulnerability Report for reproduction details.
Detection Methods for CVE-2026-14214
Indicators of Compromise
- Unexpected modifications to WordPress user records where the modifying actor holds the Amelia Manager role rather than an administrator role.
- Customer import requests to the Amelia plugin endpoints containing fields outside the documented customer schema.
- Audit log entries showing bulk user record writes originating from the Amelia import workflow.
Detection Strategies
- Review WordPress database change logs for updates to wp_users or wp_usermeta correlated with Amelia import activity.
- Inspect HTTP request bodies to Amelia admin-ajax or REST endpoints for import payloads containing unusual column names.
- Compare current user records to backups to identify unauthorized field-level modifications.
Monitoring Recommendations
- Enable WordPress audit logging with field-level granularity on user records.
- Alert on any account with a non-administrator role performing bulk user updates.
- Track version inventory of the Amelia plugin across managed WordPress sites and flag installations below 2.4.4.
How to Mitigate CVE-2026-14214
Immediate Actions Required
- Update the Booking for Appointments and Events Calendar (Amelia) plugin to version 2.4.4 or later on all WordPress sites.
- Audit accounts assigned the Amelia Manager role and revoke the role from users who do not require it.
- Review WordPress user records for unauthorized modifications performed since the plugin was installed.
Patch Information
The vendor addressed the issue in version 2.4.4 of the plugin by restricting which fields can be written through the customer import path. Administrators should apply the update through the WordPress plugin manager or by deploying the patched release from the vendor. See the WPScan Vulnerability Report for the full advisory.
Workarounds
- Restrict the Amelia Manager role to trusted administrators until the plugin is upgraded.
- Disable the customer import feature or block access to the associated admin endpoint at the web application firewall.
- Enforce multi-factor authentication for all WordPress accounts that hold plugin management privileges.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
