PT-2026-1751 · WordPress · Amelia
CVE-2025-14720
·
Publicado
2026-01-09
·
Atualizado
2026-01-09
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Amelia plugin for WordPress versions up to and including 1.2.38
Description
The Amelia plugin for WordPress is susceptible to unauthorized access because of absent capability checks on several AJAX actions. This allows unauthenticated attackers to perform actions such as marking payments as refunded, initiating the sending of queued notifications (emails, SMS, and WhatsApp), and accessing debug information. The affected AJAX actions are not explicitly detailed.
Recommendations
Update the Amelia plugin to a version later than 1.2.38.
Correção
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Amelia