What is the CVSS score of EUVD-2026-36862?

EUVD-2026-36862 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Amelia are affected by EUVD-2026-36862?

The Amelia booking plugin for WordPress (versions 2.3 and earlier) contains a privilege escalation vulnerability allowing low-privilege users to gain administrative access.

How to fix or mitigate EUVD-2026-36862?

Within 24 hours: Inventory all WordPress installations using Amelia 2.3 or earlier and document exposure. Within 7 days: Implement compensating controls including disabling the plugin if non-critical, restricting Subscriber account creation, and enabling audit logging for user privilege changes. Within 30 days: Deploy vendor patch once released or migrate to alternative booking system.

Amelia EUVD-2026-36862

| CVE-2026-48889 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-06-15 Patchstack

GHSA-5w54-736m-65hf

Privilege Escalation Amelia

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable WordPress endpoint, exploitable by any Subscriber-level account (PR:L) with no user interaction, yielding full site compromise after privilege escalation (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:43 vuln.today

DescriptionCVE.org

Subscriber Privilege Escalation in Amelia <= 2.3 versions.

AnalysisAI

Privilege escalation in the Amelia booking plugin for WordPress (versions 2.3 and earlier) allows an authenticated low-privileged user (Subscriber role) to gain higher WordPress privileges. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable flaw exploitable with only minimal account access, yielding high impact to confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Amelia (CPE cpe:2.3:a:tms:amelia) is a commercial WordPress appointment and event booking plugin published by TMS-Plugins. The root cause maps to CWE-266 (Incorrect Privilege Assignment), meaning the plugin assigns or trusts a privilege level greater than what should be granted to a Subscriber-level WordPress account, typically because a plugin endpoint relies on a request parameter or capability check that does not properly enforce the WordPress role/capability model. In WordPress, Subscriber is the lowest authenticated role and is granted automatically by many sites that allow open registration, so any plugin path that permits Subscribers to perform higher-privileged actions effectively bridges public access to administrative functionality.

RemediationAI

Patch available per vendor advisory; consult the Patchstack listing at https://patchstack.com/database/wordpress/plugin/ameliabooking/vulnerability/wordpress-amelia-plugin-2-3-privilege-escalation-vulnerability and the wpAmelia changelog to identify and install the fixed release (a version greater than 2.3) - the exact patched version was not included in the supplied data and should be confirmed against TMS-Plugins' official changelog before deployment. As an interim workaround, disable open WordPress user registration (Settings > General > 'Anyone can register') or restrict the default new-user role away from Subscriber to limit who can reach the vulnerable endpoint, accepting that this will block any legitimate self-service signup flow. Additionally, deactivating the Amelia plugin or restricting access to /wp-admin/admin-ajax.php and Amelia REST routes via a WAF rule scoped to Subscriber sessions can mitigate exploitation, with the trade-off of breaking booking functionality for legitimate authenticated users.