CVE-2026-109684: WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability
Published Oct 13, 2026
·Updated
Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.
Affected Software
1 affected component
TMS Amelia<=2.4.10
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Amelia pluginto a version that resolves this vulnerability.Fixed in 2.4.11
Event History
Oct 13, 2026
CVE Published
via MITRE·08:34 AM
Data Sourced
via MITRE·08:34 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·09:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which Amelia versions are affected?
The issue affects TMS Amelia through version 2.4.10. The available data does not identify a fixed version.
2
Can this be exploited remotely without authentication or user interaction?
Yes. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
3
What is the likely security impact?
The reported impact is limited to integrity, meaning an attacker may be able to make unauthorized changes. No confidentiality or availability impact is indicated.