EUVD-2026-51705
GHSA-xw47-5rhr-f2hq
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Amelia Manager role is a high-privilege non-default prerequisite (PR:H); only integrity applies as column writes do not expose data.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.
AnalysisAI
Unrestricted mass assignment in the Booking for Appointments and Events Calendar WordPress plugin (before 2.4.4) permits any user holding the Amelia Manager role to overwrite arbitrary database columns on stored user records by injecting unsanitized fields into customer import requests. This can enable data tampering or privilege manipulation within the booking system's user table. No public exploitation is confirmed via CISA KEV, but a POC is publicly available through WPScan; EPSS remains at 0.13% (3rd percentile), consistent with limited real-world exploitation probability given the high-privilege prerequisite.
Technical ContextAI
The vulnerability exists within the customer import handler of the Booking for Appointments and Events Calendar WordPress plugin (CPE: cpe:2.3:a:unknown:booking_for_appointments_and_events_calendar:*:*:*:*:*:*:*:*), affecting all versions prior to 2.4.4. The assigned CWE-287 (Improper Authentication) appears to be a misclassification; the actual root cause is a classic mass assignment flaw where the import endpoint performs no allowlist validation of which database columns a caller may write to. By supplying arbitrary key-value pairs - beyond those intended for the import schema - an Amelia Manager can issue write operations against any column in the stored user record, potentially including role identifiers, authentication tokens, or administrative flags managed by the plugin. This pattern, more accurately described by CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), arises when ORM or direct SQL layers bind user-supplied field names to database columns without restriction.
RemediationAI
Update the Booking for Appointments and Events Calendar WordPress plugin to version 2.4.4 or later, which introduces column restriction on the customer import feature per the vendor patch referenced at https://wpscan.com/vulnerability/4dd7bb63-e058-49d8-96ba-1fe38985e78e/. If an immediate upgrade is operationally blocked, the highest-value compensating control is to audit and restrict which users hold the Amelia Manager role to only fully trusted internal personnel, since the vulnerability is not exploitable without that role assignment. If the customer import feature is not actively required, disabling it eliminates the attack surface at the cost of bulk-import functionality. After patching or applying compensating controls, review existing booking user records for unexpected modifications to role, authentication, or privilege-adjacent columns that may indicate prior exploitation.
Unauthenticated queue-trigger exposure in the Booking for Appointments and Events Calendar WordPress plugin (versions be
Missing authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions before 2.4.9) allow
Broken object-level authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions 9.0 thr
Broken Object Level Authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions 9.0 thr
Missing authorization enforcement in the Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 allo
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today