Read the docs
TI-2026-12103 Aliases CVE-2026-14311GHSA-g24p-55f9-p54c

Missing authorization in melograno Booking for Appointments and Events Calendar – Amelia

Priority LOW 24CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing ownership verification on /users/customers/<id> endpoint in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with wpamelia-provider role, to view and modify arbitrary customers, including password reset. Takeover of WordPress user accounts, with the roles up to Editor, is also possible if that user had made an Amelia booking. This vulnerability affects only the Premium version of the plugin, where the Employee Panel is present.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00239 15th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
melogranoBooking for Appointments and Events Calendar – Ameliaup to 2.4.4—No fix listedCNA
  • Booking for Appointments and Events Calendar – Amelia Vendormelograno Affected up to 2.4.4 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-14311
  2. 2026-10-03 Alias added: GHSA-g24p-55f9-p54c

References

Other 2

  • TI-2026-07957 Improper privilege management in melograno Booking for Appointments and Events Calendar… CVSS 3.1CRITICAL 9.8
  • TI-2026-81737 Arbitrary file upload in The Innovative Form Builder IvyForms plugin CVSS 3.1HIGH 8.8
  • TI-2026-05512 Cross-site scripting in melograno Booking for Appointments and Events Calendar – Amelia CVSS 3.1HIGH 7.2
  • TI-2026-86488 Missing authorization in Amelia plugin exposes event attendee data CVSS 3.1HIGH 7.5
  • TI-2026-83520 Sensitive data exposure in Amelia booking plugin for WordPress CVSS 3.1MEDIUM 5.3
  • TI-2026-13834 Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass CVSS 3.1MEDIUM 5.3
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences