Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-14211— Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR

AI Predicted 8.5 Difficulty: Easy EPSS 0.13% · P3

Affected Version Matrix 1

VendorProductVersion RangeStatus
UnknownBooking for Appointments and Events Calendar9.0< 9.7affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-14211

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR
Source: CVE Program / CVE List V5
Vulnerability Description
The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any customer by enumerating sequential identifiers.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Amelia 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Amelia是WordPress基金会的一个预约与活动预订插件。 WordPress Amelia 9.7之前版本存在安全漏洞，该漏洞源于未验证已认证员工是否与所访问记录的客户相关，可能导致任何拥有Employee Panel登录权限的员工通过枚举顺序标识符读取和修改任意客户的存储个人数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
UnknownBooking for Appointments and Events Calendar 9.0 ~ 9.7 -

II. Public POCs for CVE-2026-14211

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-14211

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-14211 (1)

Same Patch Batch · Unknown · 2026-08-10 · 48 CVEs total

CVE-2026-17020Salon Booking System – Free Version <= 10.30.33 - Subscriber+ Arbitrary Booking PII Disclo
CVE-2026-17023Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connecti
CVE-2026-18786CheckView < 2.3.2 - Administrator Account Creation via REST API Authentication Bypass
CVE-2026-14293Autopay / Blue Media for WooCommerce < 5.0.1 - Unauthenticated Stored XSS via CSS Editor
CVE-2026-19075All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Param
CVE-2026-19074Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom F
CVE-2026-19089Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload
CVE-2026-19077Copy & Delete Posts < 1.5.5 - Authenticated Arbitrary Post Deletion via Missing Object-Lev
CVE-2026-14238Vitepos < 3.6.0 - Admin+ SQL Injection via product-details-report
CVE-2026-17021Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Arbitrary Booking Total
CVE-2026-17022Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Booking Information Disc
CVE-2026-19053ProSolution WP Client < 2.0.6 - Unauthenticated Blind SQLi via 'jobID' Parameter
CVE-2026-19049ProSolution WP Client < 2.0.9 - Unauthenticated SQLi and Plugin Data Deletion via 'removes
CVE-2026-18960Block User Account < 2.0.1 - Subscriber+ Account Block Bypass via Application Passwords
CVE-2026-18946Contact Form to Any API < 3.0.7 - Unauthenticated Sensitive File Disclosure via Predictabl
CVE-2026-18934RSS Aggregator by Feedzy < 5.2.6 - Author+ Cross-User Import Job Manipulation and Post Del
CVE-2026-15229Pinpoint Booking System <= 2.9.9.6.9 - Unauthenticated Arbitrary Booking Price Manipulatio
CVE-2026-16949Term Pages < 2.0.0 - Unauthenticated SQL Injection via tp_lookup
CVE-2026-16985Squeeze < 1.7.12 - Author+ Arbitrary File Upload
CVE-2026-15237Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments

Showing top 20 of 48 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Booking for Appointments and Events Calendar
Same vendor: Unknown

V. Comments for CVE-2026-14211

No comments yet

Leave a comment