Booking For Appointments And Events Calendar Amelia CVE-2026-5465

Requires authenticated access as a Provider (Employee) user or higher role in WordPress sites running Booking for Appointments and Events Calendar - Amelia plugin versions up to 2.1.3. Attacker exploits the UpdateProviderCommandHandler to modify the externalId field during profile update, gaining unauthorized access to arbitrary WordPress user accounts via wp_set_password() and wp_update_user().

This vulnerability presents critical real-world risk despite requiring low-level authentication (PR:L). The CVSS 8.8 score accurately reflects the severe impact: network-accessible (AV:N), low complexity (AC:L), no user interaction required (UI:N), with complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). While authentication is required, Provider-level access in booking plugins is commonly granted to non-administrative staff, significantly expanding the attack surface. The availability of public proof-of-concept is implicit through the disclosed source code references showing exact vulnerable code paths and the published patch changeset (3499608), which reveals the fix and confirms exploitability. No CISA KEV listing indicates no confirmed mass exploitation campaigns, but the WordPress plugin ecosystem's visibility and the authentication bypass nature make this a high-priority target. From an SSVC perspective: exploitation is possible (POC-equivalent via source disclosure), the attack is automatable once credentials exist, and technical impact enables total site takeover. Organizations running Amelia with multiple user roles face immediate risk of insider threats or compromised low-privilege accounts pivoting to full administrative control.

A malicious employee with Provider (Employee) credentials in an Amelia-powered WordPress booking system authenticates to their legitimate account. During a profile update operation, they intercept the HTTP request and modify the externalId parameter from their own user ID (e.g., 47) to the site administrator's user ID (e.g., 1). The vulnerable UpdateProviderCommandHandler accepts this manipulated externalId without authorization checks and passes it directly to wp_set_password() and wp_update_user(). The attacker simultaneously sets a new password, effectively hijacking the administrator account. With administrator access secured, the attacker can install malicious plugins, exfiltrate customer booking data including payment information, or establish persistent backdoors. The attack requires only network access to the WordPress site and valid Provider credentials, with no user interaction needed, making it highly reliable once initial access is obtained.