CVE-2026-96461: WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability

Q: Which deployments are affected?

The issue affects the TMS Amelia WordPress plugin (ameliabooking) through version 2.4.10. The available data does not identify a lower affected version or any unaffected configuration.

Q: Does exploitation require authentication or user interaction?

No. The supplied CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What impact is indicated?

The reported impact is integrity-only: the CVSS vector lists high integrity impact, with no confidentiality or availability impact indicated.

Published Oct 9, 2026

Updated

Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.

Affected Software

1 affected component

TMS Amelia<=2.4.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Amelia plugin to a version that resolves this vulnerability.
Fixed in 2.4.11

Event History

Oct 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

The issue affects the TMS Amelia WordPress plugin (ameliabooking) through version 2.4.10. The available data does not identify a lower affected version or any unaffected configuration.

Does exploitation require authentication or user interaction?

No. The supplied CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.

What impact is indicated?

The reported impact is integrity-only: the CVSS vector lists high integrity impact, with no confidentiality or availability impact indicated.

CVE-2026-96461: WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or user interaction?

What impact is indicated?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or user interaction?

What impact is indicated?