CVE-2026-14215: Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by enumerating its identifier.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated user can trigger the post-booking action chain if they can enumerate a booking identifier. No authentication or valid request token is required.
What impact can exploitation have?
An attacker can cause booking notifications and integration callbacks to run for a targeted booking. The provided information does not indicate that booking data can be read or modified.
Which installations are affected?
Installations using the Booking for Appointments and Events Calendar WordPress plugin before version 2.4.9 are affected.