CVE-2026-14212: Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR
The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: Booking for Appointments and Events Calendarto a version that resolves this vulnerability.Fixed in 9.8 - Compensating control
Restrict access to the plugin’s Employee Panel to only the minimum set of employees who need it, to limit which authenticated users can exploit the IDOR-based provider password update.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Amelia Pro employee (provider) with access to the Employee Panel can exploit it. The attacker does not need to own the provider account they target.
What access does an attacker gain after exploitation?
The attacker can overwrite another employee's cabinet password, allowing them to take over that employee's account.
Which deployments are affected?
WordPress sites using Amelia Pro versions before 9.8 are affected when employee accounts can log in to the Employee Panel.