Amelia EUVD-2026-109990

The affected component is the Amelia (ameliabooking) WordPress plugin on versions from n/a through 2.4.10; any WordPress site running a vulnerable Amelia version is potentially exposed. Per CVSS PR:N/UI:N, exploitation is remote and unauthenticated with no user interaction against a vulnerable installation. The available sources do not name the exact endpoint, feature, or configuration that must be reachable, and the description references 'Incorrectly Configured Access Control Security Levels,' so the specific trigger and whether any non-default configuration is required are not described in the available sources. The main limiting factor is impact scope: C:N/I:L/A:N confines the result to a low integrity effect with no confidentiality or availability loss.

This is a moderate-severity Missing Authorization flaw (CWE-862) in the Amelia WordPress booking plugin, rated CVSS 5.3. The vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity issue requiring no privileges and no user interaction, but impact is narrow: C:N/I:L/A:N means only a low integrity impact with no confidentiality or availability loss - consistent with an unauthorized actor being able to perform or alter a limited set of actions rather than achieving full compromise. The vuln.today decision label is 'this_month' (not act_now/emergency), which aligns with a real-but-non-urgent priority. No EPSS score, no CISA KEV listing, and no confirmed exploit code were provided, so there is no signal of active or widespread exploitation; exploitation status is 'no public exploit identified at time of analysis.' Signals are internally consistent here (moderate CVSS, moderate decision label, no exploitation evidence) - this reads as a genuine access-control bug worth patching on a normal cycle, not a drop-everything emergency. Note the Tags include 'Authentication Bypass,' but the CWE and Patchstack title describe broken access control / missing authorization - these are related but distinct, and the precise mechanism is not described in the available sources.

A remote, unauthenticated attacker sends a crafted request directly to an Amelia plugin endpoint whose access-control check is missing or misconfigured, invoking functionality intended to be restricted. Because only a low integrity impact applies (C:N/I:L/A:N), the likely outcome is unauthorized modification of a limited subset of booking-related data or actions rather than data theft or site takeover. No public exploit code has been identified, and the exact trigger is not described in the available sources.