Amelia Booking CVE-2026-109684

Exploitation requires only a network-reachable WordPress site running the Amelia (ameliabooking) plugin at version 2.4.10 or earlier; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no non-default configuration are needed, so default installations are affected. The description attributes the flaw to 'Incorrectly Configured Access Control Security Levels,' meaning a plugin feature/endpoint enforces insufficient authorization checks. The practical LIMIT on impact is scope: the CVSS shows only limited integrity impact (I:L) with no confidentiality or availability effect, so an attacker can perform or tamper with a restricted plugin action but cannot read protected data or take the site down through this flaw alone.

This is a medium-severity (CVSS 5.3) missing-authorization flaw (CWE-862) in the Amelia WordPress booking plugin, reported by Patchstack. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable, low-complexity issue requiring no authentication and no user interaction, which normally elevates priority - however, the impact is deliberately scoped low: C:N/I:L/A:N means no confidentiality or availability impact and only limited integrity impact, consistent with an unauthorized actor being able to invoke a restricted action or modify limited data rather than achieve full compromise. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public proof-of-concept was referenced, so there is no public exploit identified at time of analysis. The combination of easy reachability but low technical impact makes this a routine 'patch in normal cycle' item rather than an emergency: realistically exploitable but limited in damage. Note that EPSS, SSVC, and KEV data were absent from the input and could not be weighed; the only intelligence source is the single Patchstack advisory.

A remote, unauthenticated attacker sends a crafted HTTP request directly to an Amelia plugin endpoint (e.g. an AJAX or REST action) that fails to verify the caller's authorization level, allowing them to perform or alter a booking-related operation they should not be permitted to. No proof-of-concept was referenced, and the CVSS low attack complexity (AC:L) and no-interaction requirement mean the request can be replayed reliably against any affected site without special timing or configuration.