CVE-2026-14216

The Booking for Appointments and Events Calendar plugin for WordPress versions prior to 2.4.7 is vulnerable due to a lack of authentication when processing its pending notification queue. This flaw allows unauthenticated users to trigger queued notifications and integration callbacks, potentially leading to unauthorized actions or data exposure. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.