The Amelia booking plugin for WordPress is vulnerable to an authorization bypass that allows authenticated users with custom-level access and above to export a full CSV of booking records for any event. This CSV contains attendee names, email addresses, phone numbers, booking status, number of persons, price, payment status, payment amount, and coupon codes, thereby exposing highly sensitive personal and financial data. The weakness is identified as an improper authorization control (CWE-862).

Any WordPress site running the Amelia plugin version 9.9.1 or earlier is affected. The plugin is known as "Booking for Appointments and Events Calendar – Amelia" and is distributed by melograno.

The vulnerability has a moderate CVSS score of 6.5 and is not listed in the CISA KEV catalog. Because the exploit requires only an authenticated account with custom or higher privileges, it is likely to be leveraged by internal attackers or compromised user credentials. The attacker may exploit the '/report/event/bookings' endpoint to retrieve the entire dataset, but does not require additional network access beyond standard authenticated requests. The lack of EPSS data suggests the exploitation probability is not well quantified, yet the low barrier to entry and definitive data leakage mean it remains a high operational risk for sites with exposed event data.