Booking for Appointments and Events Calendar – Amelia <= 2.4.13 - Unauthenticated Missing Authorization to Booking Approval via Remote Approve Action
- ID
- WPSEC-2026-1849
- Plugin
- Booking for Appointments and Events Calendar – Amelia (ameliabooking)
- Affected
- all versions before 2.4.14
- Remediation
- Update to 2.4.14 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-863
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-28
- Attack surface
- Booking for Appointments and Events Calendar – Amelia on WPSec AttackSurface
- Fix released
- Published
Description
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Missing Authorization via the remote booking approval endpoint (/bookings/success/{id}) in all versions up to, and including, 2.4.13. This is due to the endpoint accepting the booking's customer token as authorization to approve the booking whatever its current status, while employee approval links reused that same customer token. This makes it possible for unauthenticated attackers who hold the token for their own booking, such as guest customers who receive it in the cancel link of their notification emails, to approve their own pending, rejected or canceled bookings and bypass the administrator or employee approval workflow.
References
- https://wpsec.com/vuln/WPSEC-2026-1849/
- https://plugins.svn.wordpress.org/ameliabooking/tags/2.4.14/
- https://wordpress.org/plugins/ameliabooking/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS