What is the CVSS score of CVE-2026-5465?

CVE-2026-5465 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-5465?

The Amelia WordPress plugin (versions ≤2.1.3) contains a critical privilege escalation vulnerability that allows authenticated Provider-level users to take control of any WordPress account, including…

How to fix or mitigate CVE-2026-5465?

Within 24 hours: Disable or remove the Amelia plugin from all WordPress installations and audit Provider-level user accounts for unauthorized activity. Within 7 days: Inventory all systems using Amelia ≤2.1.3, verify no unauthorized account modifications occurred, and reset all administrator credentials. Within 30 days: Evaluate alternative scheduling/booking plugins, implement application-level access controls to restrict Provider role capabilities, and deploy Web Application Firewall rules to block externalId parameter manipulation attempts until a patched version is available.

WordPress CVE-2026-5465

EUVD-2026-19580 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-07 Wordfence

WordPress Authentication Bypass

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 07, 2026 - 07:15 euvd

EUVD-2026-19580

Analysis Generated

Apr 07, 2026 - 07:15 vuln.today

CVE Published

Apr 07, 2026 - 06:43 nvd

HIGH 8.8

DescriptionCVE.org

The Booking for Appointments and Events Calendar - Amelia plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.3. This is due to the UpdateProviderCommandHandler failing to validate changes to the externalId field when a Provider (Employee) user updates their own profile. The externalId maps directly to a WordPress user ID and is passed to wp_set_password() and wp_update_user() without authorization checks. This makes it possible for authenticated attackers, with Provider-level (Employee) access and above, to take over any WordPress account - including Administrator - by injecting an arbitrary externalId value when updating their own provider profile.

AnalysisAI

Authenticated privilege escalation to Administrator in Amelia WordPress plugin (all versions ≤2.1.3) allows Provider-level users to hijack any account via Insecure Direct Object Reference. Attackers manipulate the externalId parameter during profile updates to map their session to arbitrary WordPress user IDs, including administrators, bypassing all authorization checks before password reset and user modification operations. EPSS data not provided; no confirmed active exploitation (CISA KEV) at time of analysis, though public exploit code exists via disclosed source code references.

Technical ContextAI

The vulnerability exists in the UpdateProviderCommandHandler class within the Amelia booking plugin for WordPress (CPE: cpe:2.3:a:ameliabooking:booking_for_appointments_and_events_calendar_-_amelia). The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), where the externalId field-which directly maps to WordPress core user IDs-is accepted from user input without validation. When a Provider user updates their profile, the application passes this attacker-controlled externalId to WordPress core functions wp_set_password() and wp_update_user() at lines 146, 219, and 239 of UpdateProviderCommandHandler.php. This creates a classic IDOR condition where access control relies on client-supplied identifiers rather than server-side session validation. The plugin's trust boundary failure allows low-privileged authenticated users to reference and modify high-privilege user objects by injecting target user IDs, effectively treating user-supplied keys as authoritative for access decisions.

RemediationAI

Immediately upgrade the Amelia plugin to version 2.1.4 or later, which contains the authorization fix implemented in WordPress plugin repository changeset 3499608. The patch modifies the UpdateProviderCommandHandler to properly validate externalId changes against the authenticated user's session context before invoking wp_set_password() and wp_update_user(). Site administrators should review access logs for suspicious Provider account activity, particularly profile update operations, and audit all WordPress user accounts for unauthorized privilege changes. If immediate patching is not feasible, temporarily restrict Provider-level user access or disable the profile update functionality through custom code hooks until the update can be applied. After patching, force password resets for all administrative accounts as a precautionary measure. Full technical details of the fix are available in the changeset at https://plugins.trac.wordpress.org/changeset/3499608/ameliabooking/trunk/src/Application/Commands/User/Provider/UpdateProviderCommandHandler.php. Wordfence users should ensure their firewall rules are updated to detect exploitation attempts.