CVE-2026-116388: WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability
Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Amelia pluginto a version that resolves this vulnerability.Fixed in 2.4.11
Event History
Frequently Asked Questions
Which installations are affected?
TMS Amelia installations running versions through 2.4.10 are affected. The available data does not identify a lower bound for affected versions.
Can this be exploited remotely without an authenticated account?
Yes. The vector is network-based, and the listed metrics indicate low attack complexity, no privileges required, and no user interaction required.
What is the expected impact?
The issue is rated medium with a CVSS score of 5.3. It affects integrity only; the provided metrics indicate no confidentiality or availability impact.