Quick answers
- Is CVE-2026-14311 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-14311 being exploited in the wild.
- How severe is CVE-2026-14311?
- Medium severity, with a CVSS score of 5.4, published 17 September 2026.
- Which products and versions are affected?
- Booking for Appointments and Events Calendar Amelia up to and including 2.4.4.
- Is there a fix for CVE-2026-14311?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-14311 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-14311?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a missing ownership verification flaw in the /users/customers/<id> REST API endpoint. Authenticated users with the wpamelia-provider role can send requests to access or modify arbitrary customer records without the application checking whether the requesting user owns or has permission to access that customer. An attacker with this role can view sensitive customer information, reset passwords, and potentially take over WordPress accounts with Editor role or lower if that user made an Amelia booking. The vulnerability affects all Premium versions up to and including 2.4.4; the free version is not impacted. No user interaction is required—only network access and valid plugin credentials.
Affected products
- Booking for Appointments and Events Calendar Amelia up to and including 2.4.4
Timeline
- 2026-09-17: disclosed