CVE-2024-6332mediumCWE-862

CVE-2024-6332: medium-severity vulnerability in ameliabooking Booking for Appointments and…

Booking for Appointments and Events Calendar – Amelia Premium <= 7.7 and Lite <= 1.2.4 - Missing Authorization to Sensitive Information Exposure

Published · Updated

Follow this CVE+ Monitor Booking for Appointments and Events Calendar – Amelia+ Monitor Booking for Appointments and Events Calendar – Amelia Pro

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.4%
The Booking for Appointments and Events Calendar – Amelia Premium and Lite plugins for WordPress are vulnerable to unauthorized access of data due to a missing capability check on the 'ameliaButtonCommand' function in all versions up to, and including, Premium 7.7 and Lite 1.2.4. This makes it possible for unauthenticated attackers to access employee calendar details, including Google Calendar OAuth tokens in the premium version.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
Amelia · Booking for Appointments and Events Calendar – Amelia Proameliabooking · Booking for Appointments and Events Calendar – Amelia
Related CVEs — ameliabooking Booking for Appointments and…

In the same product, most dangerous first.

CVE-2026-5465HIGHAmelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' ParameterEPSS 0.6%CVE-2022-0834HIGHAmelia <= 1.0.46 - Stored Cross Site Scripting via lastNameEPSS 0.5%CVE-2023-6808MEDIUMBooking for Appointments and Events Calendar – Amelia <= 1.0.93 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcodeEPSS 0.5%CVE-2026-2931HIGHAmelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password ChangeEPSS 0.5%CVE-2024-1484MEDIUMBooking for Appointments and Events Calendar – Amelia <= 1.0.98 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2026-6449MEDIUMBooking for Appointments and Events Calendar – Amelia <= 2.1.2 - Unauthenticated Authorization Bypass via Remote Approval EndpointEPSS 0.5%