CVE-2026-14213

The Booking for Appointments and Events Calendar plugin for WordPress has a vulnerability that allows an authenticated employee to access and view any appointment, including sensitive customer information, without proper authorization, simply by knowing the appointment's identifier. This occurs because the plugin does not properly verify the employee's assignment to the appointment in question. As a result, an attacker can exploit this weakness to obtain unauthorized access to customer data.

Based on public CVE data (MITRE/NVD).