Amelia Booking Plugin CVE-2026-6449

Exploitation requires that a booking exists in 'waiting' status on the target WordPress installation. The attacker must know or enumerate a valid booking ID and have network access to the site's wp-admin/admin-ajax.php endpoint, which is publicly accessible by default on WordPress sites. No authentication, special configuration, or user interaction is required; the flaw affects default WordPress deployments with the vulnerable plugin active. The token validation is only skipped for bookings with 'waiting' status, so bookings in other statuses (e.g., approved, rejected, completed) may retain token validation and are not affected by this specific flaw, though this boundary should be verified independently.

This vulnerability presents moderate real-world risk despite the CVSS 5.3 score (medium), which reflects limited integrity impact (I:L) and no confidentiality or availability loss. The CVSS vector (AV:N/AC:L/PR:N/UI:N) correctly indicates an unauthenticated network-accessible flaw with no user interaction required, making exploitation trivial from an attacker capability standpoint. However, exploitation is limited to bookings in 'waiting' status-not all bookings-which constrains scope. The lack of EPSS, KEV, or POC data in the provided intelligence suggests this is a newly disclosed vulnerability with limited public exploitation signals at the time of report, despite being relatively straightforward to exploit. Risk is elevated for WordPress sites hosting high-value booking services (medical, legal, event ticketing) where unauthorized approval of waiting bookings could trigger unwanted service delivery or financial transactions. Sites with manual booking review workflows may have lower immediate impact if approvals are still human-verified downstream. The attack requires familiarity with the booking ID and API endpoint structure but is otherwise not complex.

An attacker identifies a WordPress site using the Amelia booking plugin and discovers a booking ID in 'waiting' status (e.g., via the public booking page, email notifications, or site enumeration). The attacker crafts a POST request to the site's wp-admin/admin-ajax.php endpoint with the booking approval action and the target booking ID, omitting or providing a dummy security token. Due to the logical short-circuit flaw, the plugin skips token validation and immediately approves the booking, triggering automated confirmation emails, calendar updates, or service delivery workflows without the site owner's knowledge or consent.