CVE-2026-109684
5.3MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-862
Impact
Unauthenticated remote attackers can modify unauthorized booking settings or data without credentials. Network access to the WordPress site is all that is required.
Root cause
The plugin fails to perform proper authorization checks when enforcing access control levels.
Affected systems
Amelia (ameliabooking) through 2.4.10
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Fix & remediation
Upgrade Amelia to a version newer than 2.4.10 once available; if patching must wait, deactivate the ameliabooking plugin via WP-CLI or the admin dashboard.
$ wp plugin update ameliabookingAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.