What is the CVSS score of EUVD-2026-36998?

EUVD-2026-36998 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Amelia WordPress Plugin EUVD-2026-36998

| CVE-2026-40795 MEDIUM

Missing Authorization (CWE-862)

2026-06-15 Patchstack

GHSA-rqrh-627v-hmpc

Authentication Bypass Amelia

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Subscriber-level account required (PR:L), network-accessible plugin endpoint (AV:N), no confidentiality or availability impact - only data integrity manipulation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 23:06 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in Amelia <= 2.2 versions.

AnalysisAI

Broken access control in the Amelia booking plugin for WordPress (versions up to and including 2.2) allows low-privileged subscriber-level users to perform unauthorized high-integrity actions within the booking system. The flaw stems from missing authorization checks (CWE-862), permitting registered users - typically clients or end-users of the booking portal - to interact with data or functionality restricted to higher roles such as managers or administrators. No public exploit has been identified at time of analysis, and KEV listing is absent, but the low attack complexity and network accessibility make this a straightforward target once a subscriber account is obtained.

Technical ContextAI

Amelia is a WordPress appointment and event booking plugin developed by TMS (CPE: cpe:2.3:a:tms:amelia:*:*:*:*:*:*:*:*). It implements role-based access control across WordPress user roles (subscriber, employee, manager, admin). CWE-862 (Missing Authorization) indicates that one or more REST API endpoints or AJAX handlers within Amelia fail to validate whether the authenticated user holds the minimum required capability before processing a privileged request. In WordPress, the subscriber role is the lowest registered role, granted automatically to any site visitor who creates an account. The CVSS vector (PR:L) confirms that exploitation requires only this minimal authentication level. The integrity impact (I:H) without confidentiality impact (C:N) suggests the flaw enables data manipulation - such as creating, modifying, or canceling bookings that belong to other users or elevating booking permissions - rather than data disclosure.

RemediationAI

The primary remediation is to upgrade the Amelia plugin to a version above 2.2. No exact patched version number is confirmed in the available intelligence data - the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ameliabooking/vulnerability/wordpress-amelia-plugin-2-2-broken-access-control-vulnerability) should be consulted to confirm the specific fixed release before upgrading. As a compensating control where immediate upgrade is not possible, site administrators should disable open user registration (Settings > General > uncheck 'Anyone can register') to prevent untrusted parties from obtaining subscriber accounts, noting this will prevent new users from self-registering. Additionally, a Web Application Firewall (WAF) rule targeting unauthorized Amelia REST or AJAX endpoints can reduce exposure, though this requires precise endpoint identification. Both workarounds carry operational trade-offs and do not address the underlying authorization defect.