PT-2026-1751 · WordPress · Amelia

Published 2026-01-09 · Updated 2026-01-09 · CVE-2025-14720

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Amelia plugin for WordPress versions up to and including 1.2.38

Description The Amelia plugin for WordPress is susceptible to unauthorized access because of absent capability checks on several AJAX actions. This allows unauthenticated attackers to perform actions such as marking payments as refunded, initiating the sending of queued notifications (emails, SMS, and WhatsApp), and accessing debug information. The affected AJAX actions are not explicitly detailed.

Recommendations Update the Amelia plugin to a version later than 1.2.38.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14720

Affected Products

Amelia

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-14720 · Security Note
• https://plugins.trac.wordpress.org/changeset/3429650/ameliabooking/trunk/src/Application/Commands/Square/SquareRefundWebhookCommandHandler.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/771ed385-587c-400f-89c6-1a827c3e2c79?source=cve · Note
• https://twitter.com/CVEnew/status/2009526572978524176 · Twitter Post
• https://t.me/cveNotify/148184 · Telegram Post