What the vulnerability does
01Description
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 2.1.2. This is due to a logical short-circuit flaw in authorization logic that causes token validation to be entirely skipped when a booking has a 'waiting' status. This makes it possible for unauthenticated attackers to approve any booking that is in 'waiting' status by sending a crafted request to the publicly-accessible admin-ajax endpoint.
Explanation of Vulnerability in Simple Terms
02Summary
Amelia Booking for Appointments and Events Calendar versions 2.1.2 and earlier contain an integrity vulnerability that allows unauthenticated attackers to modify data over the network. The vulnerability requires no user interaction and affects the integrity of stored information. Site administrators should update to a version newer than 2.1.2 to remediate this issue.
What an attacker can do
03Attacker Capabilities
Modify data on the site without authentication.
Potential impact on your site
04Site Impact
Attackers can alter booking data, event information, or other stored content without logging in.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
May 2, 2026
CVE published
May 4, 2026
Record updated
