CVE-2026-2931highobserved exploitationCWE-269

CVE-2026-2931: high-severity vulnerability in ameliabooking Booking for Appointments and…

Amelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change

Published · Updated

Follow this CVE+ Monitor Booking for Appointments and Events Calendar – Amelia

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Actcvss 8.8epss 0.5%
from disclosure to weapon
Published on NVDMar 26
VulnCheck+39d
The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 9.1.2. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated attackers with customer-level permissions or above to change user passwords and potentially take over administrator accounts. The vulnerability is in the pro plugin, which has the same slug.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
ameliabooking · Booking for Appointments and Events Calendar – Amelia
Related CVEs — ameliabooking Booking for Appointments and…

In the same product, most dangerous first.

CVE-2026-5465HIGHAmelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' ParameterEPSS 0.6%CVE-2022-0834HIGHAmelia <= 1.0.46 - Stored Cross Site Scripting via lastNameEPSS 0.5%CVE-2023-6808MEDIUMBooking for Appointments and Events Calendar – Amelia <= 1.0.93 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcodeEPSS 0.5%CVE-2024-1484MEDIUMBooking for Appointments and Events Calendar – Amelia <= 1.0.98 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2026-6449MEDIUMBooking for Appointments and Events Calendar – Amelia <= 2.1.2 - Unauthenticated Authorization Bypass via Remote Approval EndpointEPSS 0.5%CVE-2024-6552MEDIUMBooking for Appointments and Events Calendar – Amelia <= 1.2 - Unauthenticated Full Path DisclosureEPSS 0.4%