CVE-2025-14720: Booking for Appointments and Events Calendar – Amelia <= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX Actions
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on multiple AJAX actions in all versions up to, and including, 1.2.38. This makes it possible for unauthenticated attackers to mark payments as refunded, trigger sending of queued notifications (emails/SMS/WhatsApp), and access debug information among other things.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14720?
CVE-2025-14720 is considered a medium severity vulnerability due to the potential for unauthorized access.
How do I fix CVE-2025-14720?
To fix CVE-2025-14720, upgrade the Booking for Appointments and Events Calendar – Amelia plugin to version 1.2.39 or higher.
Which versions of the Amelia plugin are affected by CVE-2025-14720?
CVE-2025-14720 affects all versions of the Amelia plugin up to and including 1.2.38.
What type of attack is facilitated by CVE-2025-14720?
CVE-2025-14720 allows unauthenticated attackers to mark payments without proper authorization.
Do I need to implement additional security measures after fixing CVE-2025-14720?
Yes, it is recommended to review and strengthen capability checks and access controls after addressing CVE-2025-14720.