CVE-2026-40789 HIGH

CVE-2026-40789: WordPress Amelia plugin <= 2.2 - Sensitive Data Exposure vulnerability

Vendor Tms
Product Amelia
Weakness CWE-201
Published June 15, 2026
Last update June 16, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Unauthenticated Sensitive Data Exposure in Amelia <= 2.2 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Amelia versions 2.2 and earlier contain an information disclosure vulnerability. An attacker on the network can read sensitive data without authentication or user interaction. The vulnerability exposes confidential information but does not allow modification or disruption of service. Update to a version newer than 2.2.

What an attacker can do

03Attacker Capabilities

Read sensitive data from the application without authentication.

Potential impact on your site

04Site Impact

Confidential information may be exposed to unauthenticated attackers over the network.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

June 15, 2026 CVE published
June 16, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2025-68029 WordPress Wallet System for WooCommerce plugin <= 2.7.3 - Sensitive Data Exposure vulnerability CVE-2026-49064 WordPress GetPaid plugin <= 2.8.49 - Sensitive Data Exposure vulnerability CVE-2026-42379 WordPress Templately plugin <= 3.6.1 - Sensitive Data Exposure vulnerability CVE-2026-39542 WordPress Doofinder for WooCommerce plugin <= 2.10.13 - Sensitive Data Exposure vulnerability CVE-2026-42667 WordPress Bookly plugin <= 27.4 - Sensitive Data Exposure vulnerability