PT-2026-28198 · WordPress · Amelia Booking Plugin

Hunter Jensen · Published 2026-03-26 · Updated 2026-03-26 · CVE-2026-2931

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Amelia Booking plugin for WordPress versions up to 9.1.2

Description The Amelia Booking plugin for WordPress is susceptible to Insecure Direct Object References. The plugin allows user-controlled access to objects, potentially enabling a user to bypass authorization and access system resources. Authenticated attackers with customer-level permissions or above may be able to change user passwords and potentially gain control of administrator accounts. The issue exists in the pro plugin.

Recommendations Update the Amelia Booking plugin to a version later than 9.1.2.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-2931

Affected Products

Amelia Booking Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-2931 · Security Note
• https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.1/src/Application/Controller/User/Customer/UpdateCustomerController.php#L30 · Note
• https://twitter.com/TheHackerWire/status/2037036180672581976 · Twitter Post
• https://twitter.com/CveFindCom/status/2037042568718848172 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/9dbaafbb-ab7b-41d8-a8f7-178b9d42b4c5?source=cve · Note
• https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.1/src/Application/Commands/User/Customer/UpdateCustomerCommandHandler.php#L173 · Note
• https://codecanyon.net/item/amelia-enterpriselevel-appointment-booking-wordpress-plugin/22067497 · Note