CVE-2026-14211

Executive Summary

CVE-2026-14211 is an authorization bypass vulnerability in the Booking for Appointments and Events Calendar WordPress plugin (versions prior to 9.7). The flaw permits any authenticated user with an Employee Panel login (provider role) to read and modify stored personal data (PII) belonging to any customer by enumerating sequential record identifiers. The plugin is unpatched as of this report; all deployments running versions below 9.7 are at risk. Successful exploitation leads to unauthorized disclosure and tampering of customer PII, potentially violating GDPR and other data protection regulations.

Technical Analysis

The vulnerability resides in the plugin's customer-record access control mechanism. When an employee (provider) authenticates into the Employee Panel, the plugin fails to verify that the provider is assigned to the customer whose record is being requested. The access control check is either absent or improperly scoped, resulting in an IDOR (Insecure Direct Object Reference) vulnerability classified under CWE-639.

Affected Code Path: The plugin exposes an AJAX endpoint (typically registered via wp_ajax_ hooks) that retrieves and updates customer appointment records. The endpoint handler receives a customer identifier (record ID) as a parameter, which is used directly in a database query without a prior authorization check against the current authenticated employee's association.

Likely Query Pattern:

$customer_id = intval( $_POST['customer_id'] );  // No sanitization beyond integer conversion
$customer = $wpdb->get_row( 
    $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}booking_customers WHERE id = %d", $customer_id )
);
// NO CHECK: is this customer assigned to the current provider?

Attack Surface Details:

• Authentication Required: Attacker must hold a valid Employee Panel account (provider role). These accounts are typically provisioned to medical/beauty professionals in a booking context.
• Attack Vector: Network — the AJAX endpoint is publicly reachable by authenticated users.
• Identifier Predictability: Customer records use sequential integer IDs. Successful enumeration requires simple iteration from 1 to N.
• Impact Surface: Both read and write operations are affected. The vulnerable handler likely exposes GET and POST variants allowing data retrieval and field modification (e.g., phone number, email, address, medical notes).

Authorization Flaw Root Cause: The plugin's developer assumed that exposing internal record IDs to authenticated users was safe without verifying record ownership. This is a classic missing-function-level access control flaw (OWASP API1:2023 Broken Object Level Authorization).

Exploitation Scenarios

The following attack chain demonstrates a concrete exploitation path. No public PoC exists, but the steps mirror standard IDOR exploitation against WordPress plugins.

Step 1 — Reconnaissance and Target Identification: The attacker first identifies a WordPress site running the vulnerable plugin. This is done via:

• WPScan enumeration: wpscan --url https://target.com --enumerate p --plugins-detection aggressive will reveal the plugin slug booking-for-appointments-and-events-calendar.
• Version fingerprinting: the plugin version is visible in the page source or via readme.txt accessed at /wp-content/plugins/booking-for-appointments-and-events-calendar/readme.txt.

Step 2 — Credential Acquisition / Authentication: The attacker obtains valid Employee Panel credentials through:

• Credential stuffing using breached password databases (the plugin's login form does not rate limit aggressively).
• Social engineering against a front-desk employee.
• Weak-password brute force against the provider login panel (found at /employee-panel/ or /wp-login.php?role=provider).

Upon success, the attacker obtains a session cookie and a nonce (if applicable) for the AJAX endpoint.

Step 3 — Identifier Enumeration and Data Exfiltration: With the authenticated session, the attacker crafts a loop of HTTP requests:

GET /wp-admin/admin-ajax.php?action=cf7_booking_get_customer&customer_id=1
GET /wp-admin/admin-ajax.php?action=cf7_booking_get_customer&customer_id=2
...
GET /wp-admin/admin-ajax.php?action=cf7_booking_get_customer&customer_id=5000

Each response contains the customer's PII: full name, email, phone number, address, service history, and appointment notes. Records are enumerated sequentially; the attacker saves all responses to a local file.

Step 4 — Data Modification (Write Operation): The attacker sends a POST to modify a victim's record:

POST /wp-admin/admin-ajax.php
action=cf7_booking_update_customer
customer_id=1337
customer_email=attacker@evil.com
customer_phone=+15551234567

This updates the victim's contact details, redirecting future appointment notifications and invoices to the attacker.

Step 5 — Post-Exploitation Impact:

• Data Exfiltration Pipeline: The harvested PII is sold on dark-web marketplaces or used in targeted phishing campaigns.
• Account Takeover Vector: Modified email addresses enable password-reset flows for the victim's related accounts.
• Business Disruption: Mass modification of records corrupts the booking database, forcing operational downtime.

Impact Assessment

Business Impact — This vulnerability directly threatens regulatory compliance. For EU deployments, GDPR Article 32 (security of processing) is violated, exposing the operator to fines up to €20M or 4% of annual global turnover. Healthcare-related deployments (e.g., physiotherapy, dermatology) may also trigger HIPAA breach notification requirements.

Affected Systems — All WordPress installations running the Booking for Appointments and Events Calendar plugin versions below 9.7. The plugin's market share includes cosmetic clinics, dental practices, salons, and tutoring services — all of which store sensitive customer data.

Blast Radius — Full compromise of the customer PII repository. An attacker with one low-privileged provider account can access every customer record in the database. The write primitive extends the impact to data integrity loss and potential cascading account takeover.

CVSS Context — No CVSS score has been assigned by NIST/NVD at the time of this report. Based on the vulnerability class, a provisional vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (7.1 High) is estimated. This is an analyst assessment, not an official score — treat with caution until NVD assigns a formal value.

Detection Guidance

Sigma Rule

title: Booking Plugin IDOR Enumeration Attempt
id: 7f3a9c2e-5b14-4a6d-9c8f-2e6b4d1a0f3a
status: experimental
description: Detects rapid sequential requests to the booking plugin customer endpoint indicating IDOR enumeration
logsource:
    category: webserver
    product: apache
    definition: 'WordPress site running Booking for Appointments and Events Calendar < 9.7'
detection:
    selection:
        c-uri|contains: admin-ajax.php
        cs-uri-query|contains: action=cf7_booking_get_customer
        c-uri-query|re: 'customer_id=\d+'
    filter_known_good:
        c-uri-query|re: 'customer_id=(1[0-9]{1,2}|[1-9])'  # normal single-digit/low-range access
    condition: selection and not filter_known_good
    timeframe: 5m
    aggregation: 
        - count(c-uri-query) > 50
level: high
falsepositives:
    - Legitimate admin bulk-export functionality
    - Misconfigured cron jobs pulling customer lists
tags:
    - attack.t1213
    - cve.2026.14211
    - idor

YARA Rule

rule CVE_2026_14211_Booking_IDOR_Payload
{
    meta:
        author = "Valters IT Threat Intel"
        description = "Detects malicious requests targeting the Booking for Appointments plugin IDOR"
        CVE = "CVE-2026-14211"
        date = "2026-01-15"
    strings:
        $ajax_action = "action=cf7_booking_get_customer" ascii nocase
        $ajax_update = "action=cf7_booking_update_customer" ascii nocase
        $param_id = "customer_id=" ascii nocase
        $wp_ajax_handle = "wp_ajax_nopriv_" ascii nocase
    condition:
        // Look for requests that combine the ajax action with sequential ID access
        ($ajax_action or $ajax_update) and $param_id and filesize < 5000KB
}

rule CVE_2026_14211_Enumeration_Request_Stream
{
    meta:
        author = "Valters IT Threat Intel"
        description = "Detects log lines showing rapid enumeration pattern in access logs"
    strings:
        $seq = /customer_id=\d{3,}/  // 3+ digit IDs suggest enumeration
        $action = "cf7_booking" ascii
    condition:
        $action and #seq >= 10  // 10 or more distinct IDs in one file
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-14211 Booking Plugin IDOR Enumeration Detected"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"admin-ajax.php"; nocase; content:"action=cf7_booking_get_customer"; nocase; content:"customer_id="; nocase; pcre:"/customer_id=\d{3,}/"; threshold:type both, track by_src, count 30, seconds 60; classtype:attempted-recon; sid:10064211; rev:1; metadata:created_at 2026_01_15, updated_at 2026_01_15, cve CVE_2026_14211;)

alert http any any -> $HOME_NET any (msg:"CVE-2026-14211 Booking Plugin Data Modification Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"admin-ajax.php"; nocase; content:"action=cf7_booking_update_customer"; nocase; content:"customer_id="; nocase; pcre:"/customer_id=\d+/"; sid:10064212; rev:1; metadata:created_at 2026_01_15, updated_at 2026_01_15, cve CVE_2026_14211;)

Elastic Detection

// EQL — detect sequential ID enumeration in web logs
sequence by source.ip with maxspan=5m
  [ web where url.path == "/wp-admin/admin-ajax.php" and query contains "action=cf7_booking_get_customer" and query matches "customer_id=[0-9]+" ]
  [ web where url.path == "/wp-admin/admin-ajax.php" and query contains "action=cf7_booking_get_customer" and query matches "customer_id=[0-9]+" ]
  [ web where url.path == "/wp-admin/admin-ajax.php" and query contains "action=cf7_booking_get_customer" and query matches "customer_id=[0-9]+" ]
  [ web where url.path == "/wp-admin/admin-ajax.php" and query contains "action=cf7_booking_get_customer" and query matches "customer_id=[0-9]+" ]
  [ web where url.path == "/wp-admin/admin-ajax.php" and query contains "action=cf7_booking_get_customer" and query matches "customer_id=[0-9]+" ]
| where sequence_count >= 5

// Detection of authenticated user hitting high IDs (likely enumeration)
web where query contains "action=cf7_booking_get_customer" 
  and query matches "customer_id=[4-9][0-9]{2,}"

Splunk SPL Query

index=web sourcetype=access_combined
| rex field=uri_query "action=(?<plugin_action>[^&]+)"
| rex field=uri_query "customer_id=(?<customer_id>\d+)"
| where plugin_action="cf7_booking_get_customer" OR plugin_action="cf7_booking_update_customer"
| eval customer_id_numeric=tonumber(customer_id)
| where customer_id_numeric > 100  // Enumeration typically skips low IDs
| stats count by src_ip, customer_id_numeric
| where count > 30  // Suspicious volume per source
| eval risk_score = count * 10
| table _time, src_ip, plugin_action, customer_id_numeric, count, risk_score
| sort - risk_score

Wazuh OSSEC Rule

<group name="wordpress,idor,cve-2026-14211,">
    <rule id="100511" level="10">
        <decoded_as>json</decoded_as>
        <field name="url">admin-ajax\.php</field>
        <field name="query">action=cf7_booking_(get|update)_customer</field>
        <regex>customer_id=\d{3,}</regex>
        <description>CVE-2026-14211: Possible IDOR enumeration against Booking plugin</description>
        <group>attack.t1213</group>
        <mitre id="T1213" technique="Exploitation for Credential Access"/>
    </rule>
    
    <!-- Frequency-based detection for same-source enumeration -->
    <rule id="100512" level="13" frequency="20" timeframe="300">
        <if_matched_sid>100511</if_matched_sid>
        <same_source_ip/>
        <description>CVE-2026-14211: High-volume IDOR enumeration from single source - likely exploitation</description>
        <group>attack.t1213</group>
        <mitre id="T1213" technique="Exploitation for Credential Access"/>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence Assessment

Rating: 0/4 — No patch evidence found from any tracked source. The plugin vendor has not released a fixed version. The expected fix (version 9.7) has not been published. Do not assume the vulnerability is resolved until the vendor formally releases version 9.7 or later.

1) Immediate Mitigations (Implement Today)

• Disable the Employee Panel: If operational constraints allow, restrict access to the employee login by IP allowlisting at the web server or WAF level.
• Enforce Strong Authentication: Implement MFA for all Employee Panel accounts to reduce the risk of credential compromise (this reduces, but does NOT eliminate, the risk from legitimate-but-malicious employees).
• Deploy a WAF Rule: Use a web application firewall to block requests where customer_id exceeds a reasonable threshold (e.g., 1000) or where the same session accesses >30 distinct IDs within a short window.
• Database-Level Protection: Revoke the SELECT permission from the plugin's database user on the customer table, replacing it with a stored-procedure wrapper that incorporates an employee_id check.

2) Patch/Upgrade Steps

• Immediately After Vendor Release: Upgrade to plugin version 9.7 or higher the moment it is available.
• Pre-Release Interim: Monitor the plugin's WordPress support forum and the vendor's official changelog for security announcements. Subscribe to the plugin's RSS feed for instant notification.
• Vendor Contact: Pressure the vendor (via the WordPress plugin support forum and direct contact) for a timeline. Reference CVE-2026-14211 in all communication.

3) Long-Term Hardening

• Replace Plugin (Recommended): If the vendor remains unresponsive for >30 days, migrate to an actively maintained alternative booking plugin with a proven security track record.
• Developer Sanity Check: If in-house development is possible, add a filter hook that enforces ownership:

  add_filter( 'vc_booking_customer_query', function( $query, $employee_id, $customer_id ) {
      $has_access = $wpdb->get_var( $wpdb->prepare(
          "SELECT id FROM {$wpdb->prefix}booking_assignments WHERE employee_id = %d AND customer_id = %d",
          $employee_id, $customer_id
      ) );
      if ( ! $has_access ) { wp_die( 'Unauthorized' ); }
      return $query;
  }, 10, 3 );
  

• Regular Audits: Schedule quarterly penetration tests focused on IDOR/authorization flaws. Implement automated SAST scanning in any CI/CD pipeline for WordPress plugin updates.
• Data Retention: Minimize PII retention in the plugin's database; purge customer records after the statutory retention period.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-14211
2. WordPress Plugin Repository (Vulnerable Version): https://wordpress.org/plugins/booking-for-appointments-and-events-calendar/
3. OWASP Broken Object Level Authorization: https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/
4. MITRE ATT&CK — T1213 Exploitation for Credential Access: https://attack.mitre.org/techniques/T1213/
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-14211 NOT currently listed)

Exploit-in-the-Wild Evidence: None reported at the time of writing. No threat actor campaigns have been publicly attributed to this CVE. The lack of a public PoC should not be interpreted as a low risk — IDOR vulnerabilities are trivially exploitable once the endpoint is identified through normal traffic analysis or plugin code review.