{
 "id": "WPSEC-2026-1849",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1849/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1849/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1849/index.md",
 "title": "Booking for Appointments and Events Calendar – Amelia <= 2.4.13 - Unauthenticated Missing Authorization to Booking Approval via Remote Approve Action",
 "description": "The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Missing Authorization via the remote booking approval endpoint (/bookings/success/{id}) in all versions up to, and including, 2.4.13. This is due to the endpoint accepting the booking's customer token as authorization to approve the booking whatever its current status, while employee approval links reused that same customer token. This makes it possible for unauthenticated attackers who hold the token for their own booking, such as guest customers who receive it in the cancel link of their notification emails, to approve their own pending, rejected or canceled bookings and bypass the administrator or employee approval workflow.",
 "plugin": {
  "slug": "ameliabooking",
  "name": "Booking for Appointments and Events Calendar – Amelia",
  "full_name": "Booking for Appointments and Events Calendar – Amelia",
  "wordpress_org": "https://wordpress.org/plugins/ameliabooking/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ameliabooking/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ameliabooking"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-863"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.4.14",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.4.14"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.4.14",
 "remediation": "Update to 2.4.14 or later.",
 "fix_released": "2026-10-27T14:42:01+00:00",
 "published": "2026-10-28T14:51:26+00:00",
 "updated": "2026-10-28T09:11:44.400444+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1849/",
  "https://plugins.svn.wordpress.org/ameliabooking/tags/2.4.14/",
  "https://wordpress.org/plugins/ameliabooking/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ameliabooking",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Low",
  "as_of": "2026-10-28"
 }
}