CVE-2026-14311

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar – Amelia (Premium version) versions prior to 2.4.5

Description Unauthorized access and modification of data occur due to missing ownership verification on the '/users/customers/' endpoint. Authenticated attackers with the wpamelia-provider role can view and modify arbitrary customer data, including triggering password resets. This can lead to the takeover of WordPress user accounts with roles up to Editor, provided the target user has made a booking through the plugin. This issue specifically affects the Premium version where the Employee Panel is enabled.

Recommendations Update the plugin to version 2.4.5 or later. Restrict access to the '/users/customers/' endpoint for users with the wpamelia-provider role until the update is applied.