What is the CVSS score of CVE-2026-6449?

CVE-2026-6449 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Amelia Booking Plugin CVE-2026-6449

EUVD-2026-26758 MEDIUM

Improper Authorization (CWE-285)

2026-05-02 Wordfence

Authentication Bypass WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 08:15 vuln.today

EUVD ID Assigned

May 02, 2026 - 08:00 euvd

EUVD-2026-26758

Analysis Generated

May 02, 2026 - 08:00 vuln.today

CVE Published

May 02, 2026 - 07:46 nvd

MEDIUM 5.3

DescriptionCVE.org

The Booking for Appointments and Events Calendar - Amelia plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 2.1.2. This is due to a logical short-circuit flaw in authorization logic that causes token validation to be entirely skipped when a booking has a 'waiting' status. This makes it possible for unauthenticated attackers to approve any booking that is in 'waiting' status by sending a crafted request to the publicly-accessible admin-ajax endpoint.

AnalysisAI

Unauthenticated attackers can approve any WordPress booking in 'waiting' status via the admin-ajax endpoint in Amelia plugin versions up to 2.1.2, due to a logical short-circuit flaw that skips token validation when the booking status matches a specific condition. An attacker can craft a direct request to the publicly-accessible endpoint to approve arbitrary bookings without authentication. This impacts all installations with pending bookings and exposes the booking workflow integrity across WordPress sites using this plugin.

Technical ContextAI

The Amelia booking plugin for WordPress uses a token-based authorization mechanism to validate requests for sensitive actions like booking approvals. The vulnerability exists in the ApproveBookingRemotelyCommandHandler and ApproveBookingRemotelyController classes, where authorization logic contains a logical short-circuit condition. When a booking's status is 'waiting', the token validation check is entirely skipped due to improper conditional logic (CWE-285: Improper Authorization), allowing the approval logic to proceed without cryptographic token verification. The vulnerability affects the public-facing admin-ajax.php endpoint, which is a standard WordPress administrative interface that does not inherently restrict unauthenticated access to all actions. The flaw is in the application-layer authorization logic rather than WordPress core.

RemediationAI

Update the Amelia plugin to a version newer than 2.1.2 immediately upon availability from the plugin author or WordPress plugin repository. The logical short-circuit flaw must be corrected in the authorization handler to ensure token validation occurs regardless of booking status. If an immediate update is unavailable, implement a temporary WAF rule or .htaccess restriction to block POST requests to wp-admin/admin-ajax.php with the booking approval action parameter until the plugin is patched; however, this will block all remote booking approvals (including legitimate ones) and is not a substitute for a proper patch. Alternatively, restrict admin-ajax.php access to authenticated users via code-level changes, but this requires custom WordPress modifications and should not replace the official plugin patch. Monitor booking logs for unexpected approval events and audit all 'waiting' status bookings approved during the vulnerability window for signs of unauthorized modifications.