Amelia CVE-2026-48889

The attacker must hold a valid WordPress account with at least Subscriber role on a site where the Amelia plugin (version 2.3 or earlier) is installed and active, as indicated by PR:L in the CVSS vector. Exploitation is limited by whether the target site permits open user registration or otherwise issues Subscriber accounts to untrusted users - closed-registration sites materially raise the bar. No user interaction is required (UI:N), the attack is network-reachable through standard HTTP/HTTPS to the WordPress site (AV:N), and no non-default plugin configuration is called out in the Patchstack advisory, so default Amelia 2.3 installations are in scope.

The CVSS 3.1 vector indicates network attack vector, low complexity, low privileges required, no user interaction, and high impact across CIA - a strong 8.8 base score. However, PR:L means an attacker must already hold a Subscriber account, which is trivial on sites with open registration but a real barrier on closed sites, so practical risk is highly site-configuration dependent. EPSS and SSVC data were not supplied in the input and no public exploit code has been identified, and the CVE is not in CISA KEV, suggesting this is currently a credible but not yet actively exploited issue. The Patchstack advisory is the sole intelligence source, and no exact patched version was provided in the input - that gap should be confirmed against the vendor before relying on remediation planning.

An attacker registers a free Subscriber account on a WordPress site running Amelia 2.3 or earlier (or uses an existing compromised low-privileged credential), then sends a crafted request to a vulnerable Amelia plugin endpoint that fails to enforce a capability check. The action elevates the attacker's effective privileges, allowing them to modify booking data, access other users' information, or pivot toward administrative control of the WordPress site. No public exploit identified at time of analysis, but the low complexity and low-privilege prerequisite make development of a working exploit straightforward once the vulnerable code path is reverse-engineered from the patch diff.