What is the CVSS score of CVE-2026-2931?

CVE-2026-2931 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-2931?

A critical vulnerability in the Amelia Booking WordPress plugin (versions ≤9.1.2) allows customer-level users to hijack administrator accounts and take over the entire website.

How to fix or mitigate CVE-2026-2931?

Within 24 hours: Audit all users with Amelia Booking access and review recent password changes and administrative activity; disable the plugin if it is not business-critical. Within 7 days: Contact CodeCanyon/the vendor for patch availability and timeline; implement network segmentation to restrict plugin access to trusted IP ranges only. Within 30 days: Apply the security patch immediately upon release; conduct a full security audit of administrator accounts and system logs for unauthorized access.

WordPress CVE-2026-2931

EUVD-2026-16095 HIGH

Improper Privilege Management (CWE-269)

2026-03-26 Wordfence

GHSA-cfxx-jfwh-m66r

WordPress Privilege Escalation

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 26, 2026 - 04:30 euvd

EUVD-2026-16095

Analysis Generated

Mar 26, 2026 - 04:30 vuln.today

CVE Published

Mar 26, 2026 - 03:37 nvd

HIGH 8.8

DescriptionCVE.org

The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 9.1.2. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated attackers with customer-level permissions or above to change user passwords and potentially take over administrator accounts. The vulnerability is in the pro plugin, which has the same slug.

AnalysisAI

The Amelia Booking plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in versions up to and including 9.1.2 that allows authenticated attackers with customer-level permissions to bypass authorization controls and modify user passwords, including administrator accounts, potentially leading to complete site takeover. This vulnerability affects the pro version of the plugin available on CodeCanyon and carries a CVSS score of 8.8 (HIGH). No evidence of active exploitation (KEV) or public proof-of-concept is currently documented, but the vulnerability has been publicly disclosed by Wordfence.

Technical ContextAI

The vulnerability affects the Amelia Booking plugin (CPE: cpe:2.3:a:ameliabooking:booking_for_appointments_and_events_calendar_-_amelia:*:*:*:*:*:*:*:*), specifically the pro version distributed via CodeCanyon. The root cause is CWE-269 (Improper Privilege Management), manifesting as an Insecure Direct Object Reference in the UpdateCustomerController.php and UpdateCustomerCommandHandler.php components. The plugin fails to properly validate whether the authenticated user has authorization to modify the target user object, allowing lower-privileged users to reference and manipulate objects (user accounts) they should not have access to. The vulnerability exists in the customer update functionality where user-controlled input can specify which user account to modify without adequate permission checks, enabling horizontal and vertical privilege escalation.

RemediationAI

Upgrade the Amelia Booking pro plugin to a version newer than 9.1.2 that addresses this IDOR vulnerability. Check the vendor's CodeCanyon product page at https://codecanyon.net/item/amelia-enterpriselevel-appointment-booking-wordpress-plugin/22067497 for the latest patched version. Until patching is completed, implement compensating controls such as restricting customer account registration to trusted users only, monitoring for suspicious password change attempts through WordPress audit logs, implementing additional authentication layers like two-factor authentication for administrative accounts, and reviewing user roles to ensure principle of least privilege. Site administrators should audit recent customer account activity and password changes to identify potential exploitation, and consider temporarily disabling customer self-service capabilities if immediate patching is not possible.