EUVD-2026-55003
GHSA-v3p7-x9gp-7j3j
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Employee role is non-admin (PR:L not PR:H); network-based IDOR with no complexity; limited C/I impact per-record enumeration.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any customer by enumerating sequential identifiers.
AnalysisAI
Broken Object Level Authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions 9.0 through 9.6) permits any authenticated employee (provider) to read and modify the stored personal data of arbitrary customers by incrementing sequential record identifiers in the Employee Panel. The plugin fails to verify that the requesting employee has a legitimate relationship with the customer being accessed, enabling horizontal privilege escalation across all customer records. A publicly available exploit exists per WPScan, though EPSS of 0.13% (3rd percentile) suggests exploitation has remained uncommon; no CISA KEV listing has been confirmed at time of analysis.
Technical ContextAI
CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause: the application uses attacker-controllable sequential integer identifiers as the sole mechanism for scoping data access, without verifying that the authenticated session's employee identity is authorized to interact with the requested customer record. This is a classic Insecure Direct Object Reference (IDOR) pattern within a multi-tenant booking workflow. The affected product is identified by CPE cpe:2.3:a:unknown:booking_for_appointments_and_events_calendar:*:*:*:*:*:*:*:* and is a WordPress plugin exposing an Employee Panel - a dedicated portal for service providers to manage appointments. The vulnerability resides in the access control layer of that panel, which does not enforce relationship-based authorization checks on customer record retrieval or update operations. The 'unknown' vendor in the CPE reflects an NVD mapping gap; WPScan independently identifies and tracks this plugin.
RemediationAI
Upgrade the Booking for Appointments and Events Calendar plugin to version 9.7 or later, which is confirmed as the patched release per vendor and EUVD-2026-55003. The WPScan advisory at https://wpscan.com/vulnerability/511d2d53-34c5-4457-bc25-6f9105b57825/ and NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-14211 should be referenced for verification. If immediate upgrade is not possible, a targeted compensating control is to disable Employee Panel access entirely until the patch is applied - this blocks the attack surface but will prevent providers from managing their appointments. Alternatively, restrict Employee Panel access by IP allowlist to only known provider offices, reducing the network exposure. Organizations subject to GDPR or similar regulations should assess whether the vulnerability constitutes a reportable data breach risk under their incident response policy, given customer PII was potentially accessible.
Unauthenticated queue-trigger exposure in the Booking for Appointments and Events Calendar WordPress plugin (versions be
Missing authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions before 2.4.9) allow
Broken object-level authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions 9.0 thr
Missing authorization enforcement in the Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 allo
Unrestricted mass assignment in the Booking for Appointments and Events Calendar WordPress plugin (before 2.4.4) permits
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today