Amelia WordPress Plugin EUVD-2026-36998

Exploitation requires the attacker to hold a valid WordPress subscriber-level account on the target site - the lowest registered user role in WordPress, obtainable via the site's standard registration page if open registration is enabled. The CVSS vector (PR:L) confirms this low-privilege authentication requirement. The target site must be running the Amelia booking plugin in versions up to and including 2.2. No additional non-default configuration is specified as a prerequisite. Limiting factors include: (1) sites that disable open user registration significantly reduce the exploitable attacker population to already-registered users, (2) scope is bounded to the Amelia plugin (S:U), preventing lateral movement to other site components, and (3) the absence of a confidentiality impact means attackers cannot harvest credentials or sensitive data through this vector alone.

The CVSS base score of 6.5 (Medium) reflects real-world risk reasonably well. The vector AV:N/AC:L/PR:L/UI:N presents a low-friction attack requiring only a valid subscriber account, which is trivially obtainable on any public WordPress site with open registration. The I:H rating signals meaningful data corruption potential within the booking system. However, scope is unchanged (S:U), meaning the attack cannot pivot beyond the Amelia plugin context, and C:N confirms no credential or data leakage. EPSS data is not provided in this intelligence set, which limits probabilistic exploitation forecasting. No KEV listing and no public POC are noted, reducing urgency compared to a weaponized vulnerability. The practical risk depends heavily on whether the affected WordPress site permits open user registration - sites with closed or invite-only registration reduce the exploitable population significantly. Overall this is a genuine medium-priority flaw worth patching promptly but not an emergency without further exploitation signals.

An attacker registers a free subscriber account on a target WordPress site running Amelia <= 2.2 - a trivial step on any site with open registration enabled. The attacker then sends crafted HTTP requests to vulnerable Amelia AJAX or REST API endpoints that lack proper authorization checks, performing actions reserved for managers or admins such as modifying or canceling other users' appointments. No public POC is known at time of analysis, but the low complexity (AC:L) suggests the exploit requires no specialized tooling beyond standard HTTP request manipulation.