The vulnerability is an Insecure Direct Object Reference in the Amelia WordPress plugin, allowing an attacker to bypass authorization by manipulating a user‑controlled key. This flaw can be used to access or modify resources that the user should not be able to reach, potentially leading to disclosure or alteration of sensitive data. The weakness is classified as CWE‑639, indicating that improper checks on resource ownership enable an unauthorized user to exploit the system.

The flaw affects the Amelia booking plugin for WordPress, versions up to and including 1.2.16. Any site running an affected version is potentially vulnerable.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests that widespread exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation. The attack vector is inferred to be a crafted request that directly references protected objects, so an attacker must be able to identify valid keys and have some level of access to interact with the plugin's endpoints.