CVE-2026-14211: IDOR exposes any customer's PII

CISO Take

This is a broken access control (IDOR) flaw in the Booking for Appointments and Events Calendar WordPress plugin: any authenticated employee/provider account can read and modify another customer's personal data simply by incrementing a sequential record ID, with no check that the employee is actually assigned to that customer. It is not an AI/ML vulnerability — the AI category tag ('ml_ui') appears to be a taxonomy artifact, not a real AI component; this is a generic WordPress data-exposure bug. The EPSS score is very low (0.15%), it is not in CISA KEV, and CISA rates it TRACK, but a public PoC exists and exploitation requires only low-privilege employee-panel access with no user interaction, so it is trivial for any malicious or compromised staff account to abuse. Action: upgrade the plugin to version 9.7 or later, and until patched, audit which staff/provider accounts have Employee Panel access and monitor for anomalous sequential record access in plugin logs. There is no AI/ML system, model, or pipeline involved, so no AI-specific mitigation is warranted.

Sources:NVDEPSSwpscan.com

What is the risk?

Low overall risk per CVSS (3.8, AV:N/AC:L/PR:High/UI:None, confidentiality+integrity impact limited to 'Low'), driven down by the requirement for an authenticated employee-level account. However, exploitability is trivial once that access is obtained — no rate limiting or object-level authorization check is implied by the description (classic IDOR/BOLA pattern), and a public PoC exists. EPSS (0.15%) and absence from CISA KEV indicate low near-term mass-exploitation likelihood; this is a targeted/insider-risk issue rather than an internet-scanning target. Real-world risk is proportional to how many employee/provider accounts exist and how trusted they are — in orgs with high staff turnover or shared/weak employee credentials, this becomes a meaningful insider-threat and data-breach vector.

How does the attack unfold?

Authenticated access

Attacker obtains or already holds a low-privilege Employee Panel (provider) login for the WordPress booking plugin.

ID enumeration

Attacker increments sequential customer/booking record identifiers without any provider-customer relationship check being enforced.

Data exposure and tampering

Attacker reads and optionally modifies personal data belonging to customers never assigned to them, exfiltrating PII across the full customer base.

Authenticated access

Attacker obtains or already holds a low-privilege Employee Panel (provider) login for the WordPress booking plugin.

ID enumeration

Attacker increments sequential customer/booking record identifiers without any provider-customer relationship check being enforced.

Data exposure and tampering

Attacker reads and optionally modifies personal data belonging to customers never assigned to them, exfiltrating PII across the full customer base.

How severe is it?

CVSS 3.1

3.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 17% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRHigh

UINone

SUnchanged

CLow

ILow

ANone

What should I do?

1 step

1) Upgrade the Booking for Appointments and Events Calendar plugin to version 9.7 or later, where the provider-to-customer relationship check should be enforced. 2) Until patched, restrict or temporarily disable Employee Panel access for non-essential staff accounts. 3) Audit Employee Panel account credentials (unique, non-shared, MFA where supported) since PR:High is the only real barrier to exploitation. 4) Review plugin/application logs for sequential ID enumeration patterns against customer record endpoints from employee accounts. 5) This is standard WordPress plugin hygiene, not an AI/ML security control — no model, agent, or pipeline changes are needed.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassPrivacy ViolationPlugin

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-14211?

This is a broken access control (IDOR) flaw in the Booking for Appointments and Events Calendar WordPress plugin: any authenticated employee/provider account can read and modify another customer's personal data simply by incrementing a sequential record ID, with no check that the employee is actually assigned to that customer. It is not an AI/ML vulnerability — the AI category tag ('ml_ui') appears to be a taxonomy artifact, not a real AI component; this is a generic WordPress data-exposure bug. The EPSS score is very low (0.15%), it is not in CISA KEV, and CISA rates it TRACK, but a public PoC exists and exploitation requires only low-privilege employee-panel access with no user interaction, so it is trivial for any malicious or compromised staff account to abuse. Action: upgrade the plugin to version 9.7 or later, and until patched, audit which staff/provider accounts have Employee Panel access and monitor for anomalous sequential record access in plugin logs. There is no AI/ML system, model, or pipeline involved, so no AI-specific mitigation is warranted.

Is CVE-2026-14211 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-14211, increasing the risk of exploitation.

How to fix CVE-2026-14211?

1) Upgrade the Booking for Appointments and Events Calendar plugin to version 9.7 or later, where the provider-to-customer relationship check should be enforced. 2) Until patched, restrict or temporarily disable Employee Panel access for non-essential staff accounts. 3) Audit Employee Panel account credentials (unique, non-shared, MFA where supported) since PR:High is the only real barrier to exploitation. 4) Review plugin/application logs for sequential ID enumeration patterns against customer record endpoints from employee accounts. 5) This is standard WordPress plugin hygiene, not an AI/ML security control — no model, agent, or pipeline changes are needed.

What is the CVSS score for CVE-2026-14211?

CVE-2026-14211 has a CVSS v3.1 base score of 3.8 (LOW). The EPSS exploitation probability is 0.26%.

What are the technical details?

Original Advisory

The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any customer by enumerating sequential identifiers.

Exploitation Scenario

A malicious or compromised employee/provider account logs into the plugin's Employee Panel as normal. Instead of only viewing their own assigned customers, they iterate through sequential customer/booking record IDs in the panel's URL or API parameter, and because the plugin never verifies the employee is actually linked to that customer, each request returns another customer's stored personal data (and in some cases allows editing it). Over a short session the attacker can harvest the full customer database of the WordPress site without triggering any authorization failure, then use the PII for fraud, harassment, or resale — no AI system or model is involved at any stage.