EUVD-2026-82496
GHSA-g24p-55f9-p54c
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable endpoint, low complexity, but requires an authenticated wpamelia-provider account (PR:L); impacts align with vendor C:L/I:L though Editor takeover could arguably justify higher integrity.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Booking for Appointments and Events Calendar - Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing ownership verification on /users/customers/<id> endpoint in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with wpamelia-provider role, to view and modify arbitrary customers, including password reset. Takeover of WordPress user accounts, with the roles up to Editor, is also possible if that user had made an Amelia booking. This vulnerability affects only the Premium version of the plugin, where the Employee Panel is present.
AnalysisAI
Broken access control in the WordPress booking plugin 'Booking for Appointments and Events Calendar - Amelia' (Premium edition, versions up to and including 2.4.4) allows an authenticated attacker holding the wpamelia-provider role to read and modify any customer record through the /users/customers/<id> endpoint, including triggering a customer password reset, because the handler never verifies that the requesting provider owns the targeted customer. The same missing ownership check can be chained to take over a linked WordPress account with a role as high as Editor, but only where that WordPress user has previously made an Amelia booking; free-version installs are unaffected because the Employee Panel does not exist there. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the Premium version of the Amelia plugin (versions ≤2.4.4) where the Employee Panel is present, and the attacker must already hold the wpamelia-provider role (an authenticated employee account). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-priority authorization flaw (IDOR/BOLA, CWE-862) rather than a critical remote-code issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact patched release version is specified in the supplied data, but an upstream fix is indicated by the plugin changeset reference (https://plugins.trac.wordpress.org/changeset/3614392/) - treat this as an upstream fix available (commit/changeset); the corresponding released patched version is not independently confirmed, so check the plugin's changelog and update the Premium Amelia plugin to the first release that includes changeset 3614392, verifying after upgrade that the /users/customers/<id> route enforces an ownership check. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user
The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in a
Missing Authorization vulnerability in TMS Amelia ameliabooking.0.98. Rated critical severity (CVSS 9.8), this vulnerabi
The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing
The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any cu
The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any cu
Blind SQL injection in the Amelia booking plugin for WordPress (Melograno Venture Studio) affects all versions from unkn
Privilege escalation in the Amelia booking plugin for WordPress (versions 2.3 and earlier) allows an authenticated low-p
The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow a
Blind SQL injection in Amelia WordPress plugin (ameliabooking) version 2.1.1 and earlier allows authenticated privileged
SQL injection in the Amelia WordPress booking plugin (versions ≤ 2.4.9) allows authenticated Editor-role users to exfilt
Unauthenticated sensitive data exposure in the Amelia (Amelia Booking) WordPress plugin versions 2.2 and earlier allows
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today