EUVD-2026-69832
GHSA-9h4g-7958-x29w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Amelia customer update endpoint unauthenticated
-
DeliverySend type=manager with externalId=0
-
ExploitPlugin creates wpamelia-manager WP user
-
ExecutionCreate provider entity linked to admin user ID
-
PersistOverwrite administrator password
-
ImpactLog in as administrator with full control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that a vulnerable Amelia Premium version (8.0-9.6.2) is installed and active on the target WordPress site and that the customer update endpoint is reachable - the exploit specifically depends on supplying the 'type' parameter set to 'manager' together with 'externalId' set to 0 to trigger wpamelia-manager user creation, then binding a provider entity to an administrator's user ID to overwrite that admin's password. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed, so exploitation works against default configurations exposed to the network; the primary limiting factor is simply running an affected plugin version. |
| Impact | All CVSS signals point to genuine high priority rather than an inflated score: the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes remote, low-complexity, unauthenticated exploitation with no user interaction and full confidentiality/integrity/availability impact - consistent with an unauthenticated-to-administrator takeover chain. The description's mechanics (attacker-controlled role parameter reachable without authentication) corroborate the PR:N/UI:N metrics, so the vector and the narrative agree. Mitigating the urgency somewhat: this is not in CISA KEV, no public POC or in-the-wild exploitation is indicated in the provided data, and EPSS is not supplied. Wordfence's involvement (a credible WordPress-focused source) raises confidence that the technical claim is real. Net assessment: treat as a real, patch-now issue for any site running an affected Amelia Premium version, while noting no confirmed active exploitation yet. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted request to Amelia's customer update endpoint setting 'type' to 'manager' and 'externalId' to 0, causing WordPress to provision a user with the wpamelia-manager role. Using that manager access, the attacker creates a provider entity bound to an existing administrator's user ID and overwrites the administrator's password, then logs in with full site control. No public POC is referenced, but the low attack complexity means exploitation would be straightforward once the request format is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Unauthenticated privilege escalation in the WordPress plugin Booking for Appointments and Events Calendar - Amelia (Premium) versions 8.0 through 9.6.2 lets remote attackers gain full administrator control of a site. By abusing insufficient validation of the 'type' parameter in the customer update endpoint (with 'externalId' set to 0), an attacker elevates a customer to the manager role, then creates a provider entity linked to an existing administrator and overwrites that administrator's password. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network reachability make this a high-priority patch for affected sites.
RemediationAI
Upgrade the Amelia Premium plugin to the first release above 9.6.2 (the vendor changelog at https://wpamelia.com/documentation/changelog/ lists the patched version - apply the latest available release; a specific fixed version is not independently confirmed in the provided data, so treat the changelog as authoritative). Until patched, restrict or disable the plugin's public customer registration/update functionality if the deployment allows it, and place the site's WordPress admin and Amelia endpoints behind a WAF with rules to block manipulation of the 'type' and 'externalId' parameters on the customer update endpoint (Wordfence provides firewall coverage) - note that disabling customer self-service will break legitimate booking flows. As a monitoring compensating control, audit for unexpected users with the wpamelia-manager role and for administrator password changes, and enforce reauthentication/2FA on administrator accounts to reduce the impact of a password overwrite.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Amelia is a commercial (Premium) appointment/event booking plugin for WordPress that maintains its own customer, provider, and role model layered on top of native WordPress users. The root cause is CWE-269 (Improper Privilege Management): the customer update endpoint trusts an attacker-supplied 'type' parameter as authoritative for role assignment instead of enforcing server-side authorization. When 'type' is set to 'manager' and 'externalId' is 0, the plugin provisions a new WordPress user carrying the wpamelia-manager role. A second flaw in provider handling then allows a manager to associate a provider entity with an arbitrary administrator user ID and reset that account's password, converting the plugin-level manager role into full WordPress administrator access. The affected package is identified in NVD CPE as cpe:2.3:a:melograno:booking_for_appointments_and_events_calendar_-_amelia (the product is distributed via wpamelia.com by TMS).
Know when Booking For Appointments And Events Calendar Amelia gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Endpoint is reachable and exploitable by unauthenticated remote attackers with no interaction, and the chain yields full administrator takeover, so PR:N/UI:N and C/I/A all High.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Booking for Appointments and Events Calendar - Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint, which allows customers to set their role to 'manager' and trigger creation of a WordPress user with the wpamelia-manager role when the 'externalId' parameter is set to 0. This makes it possible for unauthenticated attackers to escalate their privileges to administrator by first elevating to the manager role, then creating a provider entity linked to an administrator user ID and overwriting that administrator's password.
Articles & Coverage 1
Executive ViewAI
The Amelia WordPress booking plugin (Premium versions 8.0-9.6.2) contains a critical unauthenticated vulnerability enabling attackers to gain full administrator control of affected WordPress sites; no public exploit identified at time of analysis. Organizations using Amelia for appointment scheduling, service delivery, or customer bookings face immediate risk of complete site compromise and data theft. Affected sites must immediately implement interim controls and monitor for vendor patches.
No vendor-released patch identified at time of analysis. Interim controls: (1) Temporarily disable the Amelia plugin if business operations allow; (2) Implement Web Application Firewall or network-level access restrictions on WordPress admin and Amelia API endpoints to authorized networks only; (3) Enable WordPress multi-factor authentication on all administrator accounts; (4) Enable comprehensive WordPress audit logging to monitor admin user creation, role changes, password modifications, and provider entity creation; (5) Implement regular WordPress database backups and enable file-integrity monitoring; (6) Consider temporarily taking affected sites offline if processing sensitive data and unable to implement other controls quickly.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Authenticated privilege escalation to Administrator in Amelia WordPress plugin (all versions ≤2.1.3) allows Provider-lev
The Amelia Booking plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in versions up
Stored XSS in the Amelia WordPress booking plugin (versions ≤ 2.2) allows unauthenticated attackers to persist malicious
Stored Cross-Site Scripting in the Amelia Booking WordPress plugin (≤2.4.9) enables authenticated Contributor-level user
Unauthenticated information disclosure in the Amelia booking plugin for WordPress (all versions through 2.4.12) lets rem
Unauthenticated attackers can approve any WordPress booking in 'waiting' status via the admin-ajax endpoint in Amelia pl
SQL Injection in the Amelia booking plugin for WordPress (versions through 2.4.3) allows authenticated attackers holding
Exploit-DB