PT-2026-28198 · WordPress · Amelia Booking Plugin

Hunter Jensen · Publicado 2026-03-26 · Atualizado 2026-03-27 · CVE-2026-2931

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Amelia Booking plugin for WordPress versions up to 9.1.2

Description The Amelia Booking plugin for WordPress is susceptible to Insecure Direct Object References. The plugin allows user-controlled access to objects, potentially enabling a user to bypass authorization and access system resources. Authenticated attackers with customer-level permissions or above may be able to change user passwords and potentially gain control of administrator accounts. The issue exists in the pro plugin.

Recommendations Update the Amelia Booking plugin to a version later than 9.1.2.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2026-2931

Produtos afetados

Amelia Booking Plugin

Referências · 10

• https://twitter.com/Nxploited/status/2037649835256352893 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2037042568718848172 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/9dbaafbb-ab7b-41d8-a8f7-178b9d42b4c5?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.1/src/Application/Controller/User/Customer/UpdateCustomerController.php#L30 · Nota
• https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.1/src/Application/Commands/User/Customer/UpdateCustomerCommandHandler.php#L173 · Nota
• https://twitter.com/CVEnew/status/2037137747807174759 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2037036180672581976 · Publicação no Twitter
• https://codecanyon.net/item/amelia-enterpriselevel-appointment-booking-wordpress-plugin/22067497 · Nota
• https://twitter.com/BlackLanternLLC/status/2037270126379360642 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-2931 · Nota de Segurança