WordPress Booking for Appointments and Events Calendar plugin < 2.4.9 - Unauthenticated Post-Booking Action Trigger vulnerability

Unauthenticated Post-Booking Action Trigger vulnerability discovered by Haitam Lazaar in WordPress Plugin Amelia versions 2.4.9...

CVE-2026-14215

The Booking for Appointments and Events Calendar WordPress plugin (also known as Amelia ) versions before 2.4.9 is vulnerable to an unauthenticated post-booking action trigger. The root cause is a failure to require authentication or a valid request token before executing the post-booking action ...