# Booking for Appointments and Events Calendar – Amelia <= 2.4.13 - Unauthenticated Missing Authorization to Booking Approval via Remote Approve Action

- **ID:** WPSEC-2026-1849
- **Plugin:** Booking for Appointments and Events Calendar – Amelia (`ameliabooking`), https://wordpress.org/plugins/ameliabooking/
- **Affected versions:** all versions before 2.4.14
- **Fixed in:** 2.4.14 (Update to 2.4.14 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ameliabooking
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1849/

## Description

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Missing Authorization via the remote booking approval endpoint (/bookings/success/{id}) in all versions up to, and including, 2.4.13. This is due to the endpoint accepting the booking's customer token as authorization to approve the booking whatever its current status, while employee approval links reused that same customer token. This makes it possible for unauthenticated attackers who hold the token for their own booking, such as guest customers who receive it in the cancel link of their notification emails, to approve their own pending, rejected or canceled bookings and bypass the administrator or employee approval workflow.

## References

- https://wpsec.com/vuln/WPSEC-2026-1849/
- https://plugins.svn.wordpress.org/ameliabooking/tags/2.4.14/
- https://wordpress.org/plugins/ameliabooking/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1849/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.