Booking for Appointments and Events Calendar – Amelia <= 2.4.10 - Unauthenticated Unpaid Booking Injection via Additional 'bookings' Entries
- ID
- WPSEC-2026-0310
- Plugin
- Booking for Appointments and Events Calendar – Amelia (ameliabooking)
- Affected
- all versions before 2.4.11
- Remediation
- Update to 2.4.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-20
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Booking for Appointments and Events Calendar – Amelia on WPSec AttackSurface
- Fix released
- Published
Description
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.10. This is due to the public booking endpoint validating, capacity-checking and charging only the first element of the submitted bookings array, while saving every element on a newly created appointment with the customer ID, status and number of persons supplied in the request. This makes it possible for unauthenticated attackers to add extra approved bookings, assigned to arbitrary customer IDs, that bypass capacity limits and payment.
References
- https://wpsec.com/vuln/WPSEC-2026-0310/
- https://plugins.svn.wordpress.org/ameliabooking/tags/2.4.11/
- https://wordpress.org/plugins/ameliabooking/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS