Amelia Pro permits unauthenticated Administrator account takeover
Amelia Pro 8.0 through 9.6.2 insufficiently validates the type value in its customer-update endpoint. An unauthenticated attacker can set type to manager with externalId set to 0, create a WordPress wpamelia-manager account, then create a provider linked to an Administrator user ID and overwrite that Administrator's password.
- Component
- Booking for Appointments and Events Calendar – Amelia
- Plugin slug
ameliabooking- Affected
- 8.0 through 9.6.2
- Safe version
- See mitigation notes
- Published
- Sep 02, 2026
This CVE was published Sep 02, 2026 and is one of 28 known issues for this plugin.
Update, patch or deactivate.
Update to a confirmed release newer than 9.6.2 when available. Until then, disable the affected customer-update workflow when warranted, reset administrator credentials, invalidate sessions, and audit Amelia managers, providers, and account changes.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint, which allows customers to set their role to 'manager' and trigger creation of a WordPress user with the wpamelia-manager role when the 'externalId' parameter is set to 0. This makes it possible for unauthenticated attackers to escalate their privileges to administrator by first elevating to the manager role, then creating a provider entity linked to an administrator user ID and overwriting that administrator's password.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H