PT-2022-13450 · WordPress · Amelia

Huli · Published 2022-04-04 · Updated 2022-06-03 · CVE-2022-0825

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Amelia WordPress plugin versions prior to 1.0.49

Description The issue concerns a lack of proper authorization when managing appointments. This allows any customer to update the booking status of others and retrieve sensitive information about bookings, including the full name and phone number of the person who made the booking.

Recommendations For versions prior to 1.0.49, update to version 1.0.49 or later to resolve the issue. As a temporary workaround, consider restricting access to appointment management features to minimize the risk of unauthorized updates or data retrieval.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-0825

Affected Products

Amelia

References · 6

• 🔥 https://wpscan.com/vulnerability/1a92a65f-e9df-41b5-9a1c-8e24ee9bf50e · Exploit
• https://plugins.trac.wordpress.org/changeset/2693545 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-0825 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0825 · Vendor Advisory
• https://t.me/cvenotify/31100 · Telegram Post
• https://t.me/cvenotify/28748 · Telegram Post