Description

The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint, which allows customers to set their role to 'manager' and trigger creation of a WordPress user with the wpamelia-manager role when the 'externalId' parameter is set to 0. This makes it possible for unauthenticated attackers to escalate their privileges to administrator by first elevating to the manager role, then creating a provider entity linked to an administrator user ID and overwriting that administrator's password.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-02T05:17:10.937Z",
  "pubdate": "2026-09-02T05:17:10.937Z",
  "executiveSummary": "The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress contains a critical privilege escalation vulnerability affecting versions 8.0 through 9.6.2. The flaw stems from improper input validation within the customer update endpoint, enabling unauthorized actors to manipulate user roles.\nBy exploiting the 'type' and 'externalId' parameters, an attacker can elevate their privileges to the 'wpamelia-manager' role. Subsequent exploitation allows the attacker to associate a provider entity with an existing administrator account, ultimately facilitating a password reset or takeover of the administrator's account.\nThe vulnerability poses a severe risk to the integrity and confidentiality of the WordPress installation, as it grants unauthenticated or low-privileged attackers full administrative control over the site. Successful exploitation results in complete system compromise, unauthorized data access, and the potential for persistent backdoors. Immediate patching is required to prevent unauthorized privilege escalation and maintain site security.",
  "technicalDetails": "The vulnerability exists in the customer update logic of the Amelia (Premium) plugin, specifically within the endpoint responsible for processing customer profile updates. The root cause is the insufficient server-side validation of the 'type' parameter. The application fails to verify if the user initiating the request is authorized to modify their assigned role or user permissions.\nThe exploitation flow begins with the attacker targeting the customer update endpoint. By crafting a request where the 'type' parameter is manipulated, an attacker can force the application to assign them the 'wpamelia-manager' role. When the 'externalId' parameter is concurrently set to 0, the application incorrectly triggers the creation or modification of a WordPress user account associated with the 'wpamelia-manager' role.\nFollowing the initial escalation to a manager-level account, the attacker can leverage the plugin's provider management functionality. Because the application logic does not strictly enforce ownership or authorization boundaries when linking entities, the attacker can associate a new provider entity with a specific user ID. By targeting a known WordPress administrator's user ID, the attacker can manipulate the underlying database records.\nThe post-exploitation phase involves the attacker using the established link between the provider entity and the administrator account to overwrite the target administrator's password. This effectively grants the attacker full administrative access to the WordPress dashboard. Because the exploit can be initiated by unauthenticated users, the impact is comprehensive, bypassing typical access control lists (ACLs) and WordPress security roles.\nThe vulnerable component is the internal API handler that processes user update requests for the Amelia plugin. This vulnerability is persistent across all versions from 8.0 to 9.6.2 and requires no existing administrative credentials for initial access. The lack of validation on user-controlled parameters allows for direct manipulation of the WordPress user database, making it a high-severity privilege escalation vector."
}