EUVD-2026-114671
GHSA-v33c-8q9v-p4jw
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a genuine but moderate-priority exposure, not an emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3) is internally consistent with the description: a remote, unauthenticated, low-complexity request against a network-facing WordPress endpoint, with impact limited to confidentiality of a bounded data set (C:L, no integrity or availability impact). The signals do not conflict with each other. KEV status is NOT listed, so there is no confirmed active exploitation. No EPSS score was provided in the input, so exploitation probability cannot be quantified from the available data - this is a gap, not a low score. No verified working exploit code is present; the references are the Wordfence advisory and WordPress trac source-code lines pinpointing the flaw, which disclose the mechanism but are not a packaged PoC. The vendor priority label is 'this_month', which aligns with a real-but-not-critical information-disclosure issue: the ease of exploitation (unauthenticated, default behavior) raises urgency, while the limited, non-destructive impact (staff PII and internal notes, no code execution or data modification) caps it. Treat as a scheduled-patch item rather than a drop-everything incident, noting that mass automated scraping of exposed PII is plausible given the trivial trigger. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 31, 2026
Unauthenticated information disclosure in the Amelia booking plugin for WordPress (all versions through 2.4.12) lets remote attackers harvest staff personally identifiable information - full name, email address, phone number, gender and timezone - along with administrator-authored internal notes for every published event, by supplying a crafted 'page' parameter that causes the raw providers array to be serialized into the JSON response. With a CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N, confidentiality-only at C:L), the issue is a genuine but moderate-priority data leakage exposure rather than an emergency, and the available intelligence indicates no public exploit code and no confirmed active exploitation at time of analysis.
RemediationAI
Because the affected range is stated as every version up to and including 2.4.12, the remediation is to move the Amelia plugin to a release later than 2.4.12 as documented in the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/25571e59-c966-4d30-9453-42b63778b9a0?source=cve); the supplied intelligence does not name the exact patched version, so confirm the fixed release in that advisory before upgrading. The provided references are source links to the vulnerable 2.4.11 tag rather than to a fix, and no workaround or compensating control is documented in the available sources, so there is no vendor-endorsed configuration change to cite - the exposure is only fully closed by running a patched build of the plugin.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Amelia is a commercial WordPress booking and events plugin from Melograno that serves event and appointment data through PHP controller and command classes; the supplied references point at GetEventsController.php and GetEventsCommandHandler.php within the 2.4.11 plugin tag, plus the plugin's main bootstrap file (ameliabooking.php). The root cause is CWE-200, Exposure of Sensitive Information to an Unauthorized Actor: the event-listing response carries the full provider (staff) record array and administrator-authored internal notes, and that raw array is never stripped or reduced to a public-safe projection before the payload is serialized to JSON. Per the CVSS vector the reachable path requires no authentication (PR:N) and no user interaction, so a request carrying a manipulated 'page' parameter is enough to return the leaked fields for every provider and every published event; impact is confidentiality-only (C:L) with no integrity or availability effect. The specific code locations for the trigger are identified by the referenced source lines rather than spelled out in the advisory text.
Know when Booking For Appointments And Events Calendar Amelia gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (Wordfence).
CVSS VectorNVD
DescriptionNVD
The Booking for Appointments and Events Calendar - Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.12 via the 'page' parameter. This makes it possible for unauthenticated attackers to extract staff personally identifiable information - including full name, email address, phone number, gender, and timezone - as well as administrator-authored internal notes for every published event, all serialized into the JSON response because the raw providers array is never stripped before output.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated privilege escalation in the WordPress plugin Booking for Appointments and Events Calendar - Amelia (Prem
Authenticated privilege escalation to Administrator in Amelia WordPress plugin (all versions ≤2.1.3) allows Provider-lev
The Amelia Booking plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in versions up
Stored XSS in the Amelia WordPress booking plugin (versions ≤ 2.2) allows unauthenticated attackers to persist malicious
Stored Cross-Site Scripting in the Amelia Booking WordPress plugin (≤2.4.9) enables authenticated Contributor-level user
Unauthenticated attackers can approve any WordPress booking in 'waiting' status via the admin-ajax endpoint in Amelia pl
SQL Injection in the Amelia booking plugin for WordPress (versions through 2.4.3) allows authenticated attackers holding
Exploit-DB