CVE-2026-77705: Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover

Q: Which users could exploit this issue?

Users who hold Amelia customer or employee management permissions could exploit it. The issue arises because those permissions do not ensure the user is entitled to modify the linked WordPress account.

Q: What can an attacker change to take over an account?

An authorized Amelia customer or employee manager can set the password and email address of another user's linked WordPress account, enabling account takeover.

Q: Which versions are affected?

Amelia versions before 2.4.10 are affected.

Published Sep 12, 2026

Updated

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.

Affected Software

1 affected component

Amelia Amelia Manager+<2.4.10

Event History

Sep 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users could exploit this issue?

Users who hold Amelia customer or employee management permissions could exploit it. The issue arises because those permissions do not ensure the user is entitled to modify the linked WordPress account.

What can an attacker change to take over an account?

An authorized Amelia customer or employee manager can set the password and email address of another user's linked WordPress account, enabling account takeover.

Which versions are affected?

Amelia versions before 2.4.10 are affected.