Security Advisory

CVE-2026-14215

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-02 06:00:16

Last updated 2026-09-02 10:45:59

Assigner WPScan

CVSS score 6.5

State PUBLISHED

Description

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by enumerating its identifier.

← Browse all CVEs View on cve.org ↗