What is the CVSS score of CVE-2026-96461?

CVE-2026-96461 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-96461?

Within 24 hours, inventory every WordPress installation that runs the TMS Amelia booking plugin and confirm whether any instance is at version 2.4.10 or earlier; treat all such instances as affected since no vendor-released patch has been identified, and prioritize those reachable from the internet. Immediately restrict access to the affected plugin endpoints at the web application firewall or reverse proxy to trusted networks only, and consider temporarily deactivating the plugin on the highest-exposure sites where booking functionality is non-critical. Within 7 days, validate the inventory is complete, deploy virtual patching or WAF rules that block unauthorized modification attempts against the plugin's endpoints, confirm that no anomalous changes to booking or customer records have occurred through log and database integrity review, and open a tracking ticket with the plugin vendor to obtain a fixed version or an estimated release date. Within 30 days, apply the vendor patch as soon as it is released and re-test, or if no fix is forthcoming, replace the plugin with a maintained alternative; document the interim compensating controls, add the plugin to continuous software-composition and WordPress component monitoring so future advisories are caught automatically, and report residual risk and the eventual remediation outcome to security management.

TMS Amelia CVE-2026-96461

EUVD-2026-95595 HIGH

Missing Authorization (CWE-862)

2026-10-09 Patchstack

GHSA-8gm3-2259-xx5m

WordPress Authentication Bypass Amelia Wordpress Plugin Tms

7.5

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach WordPress site over network
Delivery

Send crafted request to Amelia endpoint
Exploit

Bypass missing authorization check
Execution

Perform privileged booking action
Impact

Tamper with booking data (integrity impact)

Vulnerability Assessment

Weakness	CWE CWE-862 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Authorization checks on every request MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions - remote unauthenticated exploitation is possible against default configurations of the Amelia booking plugin, since the CVSS vector (AV:N/AC:L/PR:N/UI:N) and the description ('Incorrectly Configured Access Control Security Levels', CWE-862) indicate a network-facing endpoint that fails to enforce authorization. The practical prerequisites are: the Amelia plugin installed and active on a network-reachable WordPress site, and a plugin version at or below 2.4.10. The main limiting factor is impact scope - per the vendor vector the impact is integrity-only (C:N/A:N), so the flaw enables unauthorized actions/data modification rather than data disclosure or denial of service; the exact privileged function exposed is not detailed in the available data and should be confirmed against the Patchstack advisory.
Impact	This is a missing-authorization flaw (CWE-862) in the Amelia WordPress booking plugin, scored CVSS 7.5 with vector AV:N/AC:L/PR:N/UI:N and an integrity-only impact (C:N/I:H/A:N). The CVSS signals are internally consistent and point to a network-reachable, low-complexity, unauthenticated issue - PR:N confirms no authentication is required. The 7.5 score is driven entirely by the high integrity impact; there is no confidentiality or availability loss, so this is a data-tampering/unauthorized-action issue rather than data theft or disruption. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. Net assessment: a credible, remotely exploitable access-control weakness in a widely-used plugin that warrants prompt patching, but with no current evidence of active exploitation or weaponization. Treat as a real patch priority for exposed WordPress sites while recognizing the risk is bounded to integrity-type impact, not full compromise, based on the vendor CVSS.
Exploit ScenarioDerived	A remote, unauthenticated attacker sends a crafted HTTP request directly to an Amelia plugin AJAX/REST endpoint that fails to verify the caller's authorization level, invoking a privileged booking action (such as modifying or creating booking data) without logging in. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network reachability to the WordPress site and no user interaction. No public proof-of-concept is referenced in the provided data.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 09, 2026

Remote unauthenticated attackers can exploit a missing authorization flaw (CWE-862) in the TMS Amelia WordPress booking plugin versions up to and including 2.4.10, allowing unauthorized modification of data on affected sites (CVSS 7.5, integrity-only impact). The vulnerability stems from an endpoint that fails to enforce proper access control, and no public exploit code has been identified at time of analysis; WordPress installations running the plugin and reachable over the network are at risk.

RemediationAI

No vendor-released patch was identified at time of analysis based on the available data; administrators should monitor the Patchstack advisory and the plugin's official channels for a fixed version. Until a patch is available, consider disabling the Amelia plugin if booking functionality is not essential - this eliminates the attack surface but removes all booking features. If the plugin must remain active, restrict access to its endpoints (for example, block unauthenticated requests to /wp-json/amelia/ or the relevant admin-ajax.php actions) using a web application firewall or server-level rules, but be aware this may break public-facing booking forms and other legitimate functionality. Additionally, ensure the WordPress site uses least-privilege principles and review any custom user roles for unnecessary permissions. No specific compensating control from the vendor was provided in the input data.

Affected VersionsENISA

Amelia 0 ≤2.4.10

Affected Packages

euvd amelia no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw is a classic missing authorization issue (CWE-862) in a WordPress plugin, where a network-accessible function fails to verify that the requester possesses the necessary capabilities or nonce. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N indicates that an unauthenticated attacker can reach the vulnerable code path without user interaction, and the sole impact is to integrity (unauthorized data modification), with no confidentiality or availability impact per the assessed vector. CPE cpe:2.3:a:tms:amelia:*:*:*:*:*:*:*:* covers all versions of the plugin, and the description notes versions through 2.4.10 are affected. As a booking plugin, Amelia manages appointments, customer records, and scheduling data, so the exposed privileged function could allow tampering with bookings or related configuration, though the exact function is not detailed in the available data.

Know when Tms gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI 7.5 HIGH

Missing authorization on a network endpoint requires no auth (PR:N) or interaction (UI:N) and is low-complexity; impact is unauthorized actions so I:H with C:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

DescriptionCVE.org

Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.

Executive ViewAI

Why It Matters

Sites running the TMS Amelia booking plugin at versions up to and including 2.4.10 expose their booking and customer data to unauthorized modification by any network-reachable party, with no vendor fix currently available. Because the flaw permits data alteration without legitimate access, affected organizations face integrity risk to booking records, pricing and customer information that customers and staff rely on. Leadership should care because every internet-facing WordPress installation carrying this plugin remains exposed until it is disabled or otherwise isolated, and remediation depends on vendor action rather than internal patching.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove the TMS Amelia plugin on internet-facing sites until a fixed version is available; restrict access to the plugin's endpoints to trusted networks or authenticated users at the WAF, reverse proxy, or load balancer; apply virtual patching or custom WAF rules that block unauthorized write requests to the affected endpoint; monitor booking, pricing, and customer records for unexpected modification and review web server and application logs for anomalous requests; maintain offline backups of booking and customer data to support rapid restoration if tampering is detected.

Threat Intelligence Overview

EPSS Score

0.2%

Top 91% exploitable

Prevalence

Medium

Popular WordPress booking plugin, widely installed but not universal

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.