Description

Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-10-09T10:16:45.000Z",
  "pubdate": "2026-10-09T10:16:45.000Z",
  "executiveSummary": "This vulnerability involves a Missing Authorization flaw within the TMS Amelia ameliabooking plugin, categorized as an Incorrectly Configured Access Control Security Level issue.\nThe vulnerability resides in versions ranging from n/a through 2.4.10, impacting the integrity and confidentiality of the booking management system.\nThe flaw allows unauthorized users to perform actions or access data restricted to higher-privileged accounts due to insufficient server-side validation of user permissions.\nThe risk implication is significant as it permits an attacker to bypass intended access control mechanisms without requiring authentication or by leveraging lower-privileged access.\nAttackers can exploit this via malicious requests directed at the plugin’s sensitive endpoints, potentially leading to unauthorized data manipulation or administrative actions depending on the specific functions exposed by the misconfigured access controls.",
  "technicalDetails": "The vulnerability stems from the implementation of insufficient authorization checks within the TMS Amelia ameliabooking plugin's internal request handling logic.\nSpecifically, the affected components fail to verify the security clearance or roles of the requesting user before executing sensitive plugin-related functions.\nRoot cause analysis indicates that the authorization layer relies on client-side state or lacks explicit capability checks for specific server-side actions, enabling an attacker to invoke restricted methods.\nThe attack flow begins with the discovery of insecurely exposed REST API endpoints or AJAX handlers within the ameliabooking plugin. By crafting unauthorized HTTP requests (GET, POST, etc.) aimed at these endpoints, an attacker bypasses the expected WordPress 'current_user_can' or similar capability verification processes.\nBecause the system fails to enforce rigorous access control checks on the server side, the backend processes the requests as if they originated from an authorized administrator or user with sufficient privileges.\nExploitation allows for the unauthorized access or modification of plugin settings, booking information, and potentially other sensitive data stored within the plugin database.\nThe scope of impact is broad, as the vulnerability affects all versions of the plugin from its inception through 2.4.10. The lack of proper privilege validation implies that the plugin does not correctly validate the session or authorization tokens associated with the request context.\nPost-exploitation, an attacker could potentially gain control over booking calendars, manipulate customer data, or execute administrative tasks that are otherwise protected.\nThe vulnerability is accessible over the network, assuming the attacker can reach the web server hosting the vulnerable WordPress installation, requiring no specialized authentication beyond what is provided by the flaw itself."
}