CVE-2026-14214

A vulnerability exists in the Booking for Appointments and Events Calendar plugin prior to version 2.4.4, where an unauthorized modification can be made to user records through its customer import feature. Specifically, a user with the Amelia Manager role can manipulate arbitrary columns of stored user data by including them in the import request.

Based on public CVE data (MITRE/NVD).