The Booking for Appointments and Events Calendar – Amelia plugin for WordPress allows unauthenticated attackers to retrieve confidential staff personal data, including full name, email address, phone number, gender, and timezone, as well as administrator‑written internal notes for any public event. This information is exposed because the plugin includes the entire raw providers array in the JSON response without filtering or sanitizing sensitive fields, leading to a direct breach of data confidentiality.

All installations of the Amelia WordPress plugin with versions 2.4.12 or earlier are vulnerable. The affected product is the Booking for Appointments and Events Calendar – Amelia plugin developed by melograno for WordPress. Users of any WordPress site that has this plugin installed and has exposed event endpoints are affected.

The vulnerability has a CVSS score of 5.3, indicating a moderate risk level. While the EPSS score is not available, the lack of authentication required and the straightforward nature of the attack vector—sending an unauthenticated request containing the 'page' parameter to the plugin’s event endpoint—make exploitation relatively easy. The vulnerability is not listed in CISA’s KEV catalog, but the potential for privacy breaches warrants immediate attention.