CVE-2026-77705highCWE-639

CVE-2026-77705: falha de alta gravidade em Booking for Appointments and Events Calendar

Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover

Publicada em

Seguir esta CVE+ Monitorar Booking for Appointments and Events Calendar

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

41Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 7.2epss 0.5%
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Unknown · Booking for Appointments and Events Calendar
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Booking for Appointments and Events Calendar

No mesmo produto, das mais perigosas para as menos.

CVE-2026-14215MEDIUMAmelia < 2.4.9 - Unauthenticated Post-Booking Action TriggerEPSS 0.4%CVE-2026-14216MEDIUMAmelia < 2.4.7 - Unauthenticated Notification Queue DispatchEPSS 0.4%CVE-2026-77689MEDIUMAmelia Pro 9.0 - 9.8 - Unauthenticated Payment BypassEPSS 0.3%CVE-2026-14212MEDIUMAmelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOREPSS 0.3%CVE-2026-77704LOWAmelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-ApprovalEPSS 0.3%CVE-2026-14214LOWAmelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass AssignmentEPSS 0.3%