CVE-2026-2931highexploração observadaCWE-269

CVE-2026-2931: falha de alta gravidade em ameliabooking Booking for Appointments and…

Amelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Booking for Appointments and Events Calendar – Amelia

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

43Vexday Risk Score

Priorize a correção. Ela exploração observada pelo VulnCheck.

ssvc Actcvss 8.8epss 0.5%
da publicação à arma
Publicada no NVD26 de mar.
VulnCheck+39d
The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 9.1.2. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated attackers with customer-level permissions or above to change user passwords and potentially take over administrator accounts. The vulnerability is in the pro plugin, which has the same slug.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
ameliabooking · Booking for Appointments and Events Calendar – Amelia
CVEs relacionadas — ameliabooking Booking for Appointments and…

No mesmo produto, das mais perigosas para as menos.

CVE-2026-5465HIGHAmelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' ParameterEPSS 0.6%CVE-2022-0834HIGHAmelia <= 1.0.46 - Stored Cross Site Scripting via lastNameEPSS 0.5%CVE-2023-6808MEDIUMBooking for Appointments and Events Calendar – Amelia <= 1.0.93 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcodeEPSS 0.5%CVE-2024-1484MEDIUMBooking for Appointments and Events Calendar – Amelia <= 1.0.98 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2026-6449MEDIUMBooking for Appointments and Events Calendar – Amelia <= 2.1.2 - Unauthenticated Authorization Bypass via Remote Approval EndpointEPSS 0.5%CVE-2024-6552MEDIUMBooking for Appointments and Events Calendar – Amelia <= 1.2 - Unauthenticated Full Path DisclosureEPSS 0.4%