The Amelia Booking for Appointments and Events Calendar plugin in WordPress contains an unauthenticated full path disclosure flaw in the wpAmeliaApiCall function. An attacker can retrieve absolute server paths via this endpoint. Although the disclosed information does not directly compromise data, it constitutes an information disclosure that can be leveraged to locate critical files and aid other attacks.

Any WordPress site that runs the Amelia plugin version 1.2.19 or earlier is affected. The flaw exists in all releases up to and including 1.2.19 and is present in the plugin code base for WordPress installations that have not been updated beyond that version.

The CVSS score of 5.3 reflects moderate severity, while the EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog. An unauthenticated attacker can exploit the flaw by sending a request to wpAmeliaApiCall. The disclosed paths alone do not permit direct compromise, but the information can aid further attacks if another weakness exists.