Booking For Appointments And Events Calendar Amelia EUVD-2026-16095

Requires Amelia Booking plugin for WordPress versions up to 9.1.2 with pro version enabled. Attacker must be an authenticated user with minimum customer-level permissions. No user interaction needed. Remote network access only. Allows password changes and administrator account takeover.

This vulnerability presents a high real-world risk despite requiring authentication. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network-based exploitation with low complexity requiring only low privileges and no user interaction, with high impact across confidentiality, integrity, and availability. The attack requires only customer-level credentials, which are easily obtainable through legitimate registration on booking sites. The ability to escalate to administrator access represents critical risk for WordPress installations, as full site compromise becomes trivial once admin credentials are captured. While no EPSS score or KEV listing is provided and no public exploit code is referenced, the technical details in the WordPress plugin repository (UpdateCustomerController.php and UpdateCustomerCommandHandler.php) provide sufficient information for exploit development. This should be considered a genuine priority for organizations using the Amelia Booking pro plugin, as the combination of low attack complexity, minimal privilege requirements, and severe impact (administrator account takeover) creates significant exposure.

An attacker registers a legitimate customer account on a WordPress site using the Amelia Booking plugin to schedule appointments. Once authenticated with customer-level privileges, the attacker crafts malicious requests to the UpdateCustomerController endpoint, manipulating object references to target administrator user accounts instead of their own. By exploiting the IDOR vulnerability, the attacker successfully changes an administrator's password without authorization checks, then logs in with the compromised administrator credentials to gain complete control over the WordPress site, including the ability to install malicious plugins, steal customer data, or deface the website.