CVE-2026-14214: Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: Amelia < 2.4.4 (Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment)to a version that resolves this vulnerability.Fixed in 2.4.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14214?
CVE-2026-14214 has a risk score of 47, indicating a moderate severity level.
How do I fix CVE-2026-14214?
To fix CVE-2026-14214, update the WordPress Amelia plugin to version 2.4.4 or later.
What can attackers do with CVE-2026-14214?
Attackers can exploit CVE-2026-14214 to modify arbitrary user fields through mass assignment if they have the Amelia Manager role.
Who is affected by CVE-2026-14214?
Sites using the Amelia plugin for WordPress versions prior to 2.4.4 are affected by CVE-2026-14214.
When was CVE-2026-14214 published?
CVE-2026-14214 was published on August 1, 2026.