CVE-2026-9055: Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'
The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint, which allows customers to set their role to 'manager' and trigger creation of a WordPress user with the wpamelia-manager role when the 'externalId' parameter is set to 0. This makes it possible for unauthenticated attackers to escalate their privileges to administrator by first elevating to the manager role, then creating a provider entity linked to an administrator user ID and overwriting that administrator's password.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: Booking for Appointments and Events Calendar – Amelia (Premium)to a version that resolves this vulnerability.Fixed in 9.6.2 - Operational
After applying the fix, check for newly created WordPress users with the wpamelia-manager role and for any provider entities linked to administrator user IDs; if any are found, reset the affected administrators’ passwords.
Event History
Frequently Asked Questions
Which installations are affected?
WordPress sites using the Amelia (Premium) plugin in versions 8.0 through 9.6.2 are affected.
Does exploitation require an existing customer or WordPress account?
No. The vulnerability can be exploited by an unauthenticated attacker through the customer update endpoint.
What conditions does the attacker use to reach administrator access?
The attacker sets the attacker-controlled type parameter to make a customer a manager and sets externalId to 0, causing creation of a WordPress user with the wpamelia-manager role. They can then create a provider linked to an administrator user ID and overwrite that administrator's password.