CVE-2026-104992mediumCWE-862

CVE-2026-104992: fallo de gravedad media en melograno Booking for Appointments and Events…

Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Authenticated (Custom+) Sensitive Information Disclosure via '/report/event/bookings' Endpoint

Publicada el

Seguir esta CVE+ Monitorear Booking for Appointments and Events Calendar – Amelia

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

10Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.9.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to export a full CSV of booking records for any event on the site — including attendee names, email addresses, phone numbers, booking status, number of persons, price, payment status, payment amount, and coupon codes — regardless of whether they own or participate in those events.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Productos afectados
melograno · Booking for Appointments and Events Calendar – Amelia
CVEs relacionadas — melograno Booking for Appointments and Events…

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-6286HIGHBooking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking SubmissionEPSS 0.6%CVE-2026-9055CRITICALBooking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'EPSS 0.5%CVE-2026-10148MEDIUMBooking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' ParameterEPSS 0.4%CVE-2026-14782MEDIUMBooking for Appointments and Events Calendar – Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer ImportEPSS 0.4%CVE-2026-16582MEDIUMBooking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment BypassEPSS 0.3%CVE-2026-103915MEDIUMBooking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' ParameterEPSS 0.3%