CVE-2026-14214 — Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment

CVE-2026-14214

Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment PUBLISHED

Description (CNA)

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.

Affected (CNA)

Vendor / product	Versions
Unknown / Booking for Appointments and Events Calendar	affected 0 before 2.4.4

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/4dd7bb63-e058-49d8-96ba-1fe38985e78e/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.