CVE-2026-6449mediumCWE-285

CVE-2026-6449: fallo de gravedad media en ameliabooking Booking for Appointments and…

Booking for Appointments and Events Calendar – Amelia <= 2.1.2 - Unauthenticated Authorization Bypass via Remote Approval Endpoint

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Booking for Appointments and Events Calendar – Amelia

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.5%
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 2.1.2. This is due to a logical short-circuit flaw in authorization logic that causes token validation to be entirely skipped when a booking has a 'waiting' status. This makes it possible for unauthenticated attackers to approve any booking that is in 'waiting' status by sending a crafted request to the publicly-accessible admin-ajax endpoint.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Productos afectados
ameliabooking · Booking for Appointments and Events Calendar – Amelia
CVEs relacionadas — ameliabooking Booking for Appointments and…

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-5465HIGHAmelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' ParameterEPSS 0.6%CVE-2022-0834HIGHAmelia <= 1.0.46 - Stored Cross Site Scripting via lastNameEPSS 0.5%CVE-2023-6808MEDIUMBooking for Appointments and Events Calendar – Amelia <= 1.0.93 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcodeEPSS 0.5%CVE-2026-2931HIGHAmelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password ChangeEPSS 0.5%CVE-2024-1484MEDIUMBooking for Appointments and Events Calendar – Amelia <= 1.0.98 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2024-6552MEDIUMBooking for Appointments and Events Calendar – Amelia <= 1.2 - Unauthenticated Full Path DisclosureEPSS 0.4%