CVE-2026-14214 describes an improper authentication vulnerability (CWE-287) in the Booking for Appointments and Events Calendar WordPress plugin. Specifically, versions prior to 2.4.4 do not restrict field-level write permissions during customer import, enabling users with the Amelia Manager role to alter arbitrary columns in any stored user record by including them in the import request. This flaw could allow unauthorized modification of user data by authorized roles beyond intended scope.

An attacker with the Amelia Manager role can modify arbitrary user record fields via the import functionality, potentially leading to unauthorized changes to user data. This could affect data integrity and trustworthiness of stored user information. There is no indication of remote unauthenticated exploitation or privilege escalation beyond the Amelia Manager role.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict the Amelia Manager role's permissions to trusted users only and monitor import activities closely. Avoid importing customer data from untrusted sources.