CVE-2026-16582: Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating it. This makes it possible for unauthenticated attackers to create approved appointment bookings without completing payment
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it; no WordPress account, prior privileges, or user interaction is required.
What does an attacker need to bypass payment?
The attacker needs to supply a package-redemption identifier accepted by the plugin. The affected plugin treats that client-supplied identifier as proof of payment without validating it.
What is the practical impact?
An attacker can create appointment bookings that are marked approved without completing payment. The reported impact is unauthorized modification of booking data, with no reported confidentiality or availability impact.
Which installations are affected?
Amelia versions up to and including 2.4.5 are affected. The provided data does not identify any configuration prerequisite, so deployments using an affected version should be treated as exposed.