Description

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-12T06:16:24.967Z",
  "pubdate": "2026-09-12T06:16:24.967Z",
  "executiveSummary": "The Booking for Appointments and Events Calendar (Amelia) WordPress plugin prior to version 2.4.10 contains a critical insecure direct object reference (IDOR) vulnerability.\nThe vulnerability resides in the customer and employee management modules, where the plugin fails to enforce proper authorization checks when updating user-related data.\nAn attacker possessing basic Amelia-specific management permissions can exploit this flaw to modify the WordPress account details associated with other users, including administrators.\nBy manipulating request parameters, an attacker can overwrite the email address and password of any targeted WordPress account, leading to complete unauthorized account takeover.\nThis vulnerability poses a significant risk to organizational security, as it allows low-privileged users to escalate their privileges to a full administrative level, potentially compromising the entire WordPress environment.\nExploitation does not require external tools beyond the standard web interface, as the attack is performed by intercepting and modifying legitimate administrative API requests or form submissions sent to the plugin's backend.",
  "technicalDetails": "The root cause of this vulnerability is a broken access control mechanism within the Booking for Appointments and Events Calendar plugin. Specifically, the backend logic responsible for processing updates to customer and employee records lacks an authorization validation layer to ensure that the currently authenticated user has the necessary ownership or administrative rights over the WordPress user object being modified.\nWhen a user with Amelia management permissions attempts to update an employee or customer profile, the plugin transmits a request—typically containing the target user ID and associated profile data—to the server. Because the plugin logic implicitly trusts the user ID provided in the request without verifying the requester's authority over that specific account record, an attacker can modify the request parameters to reference a victim's User ID (UID).\nAn attacker can exploit this by intercepting the legitimate 'save' request triggered within the Amelia interface. By replacing the legitimate ID with that of a targeted user (such as a WordPress Administrator), the attacker can inject their own email address or force a password reset/change for the target account. Because the application logic maps the Amelia record directly to the WordPress user database, modifying the email field allows the attacker to trigger a password reset via the standard WordPress recovery flow, effectively completing the account takeover.\nThe attack flow follows these steps: 1) The attacker authenticates as a user with sufficient permissions to view or edit Amelia records. 2) The attacker initiates an edit action on a record they own. 3) Using an intercepting proxy, the attacker captures the request sent to the server. 4) The attacker modifies the request payload, swapping the target parameter for the ID of a high-privilege WordPress user. 5) The server processes the request, updating the victim's account credentials in the 'wp_users' table based on the attacker's input. 6) The attacker uses the newly assigned email to perform a password reset or directly logs into the compromised account.\nThis flaw affects all versions of the Booking for Appointments and Events Calendar plugin prior to 2.4.10. Successful exploitation grants the attacker the permissions associated with the victim's account, often resulting in full site compromise."
}