The vulnerability is an authorization flaw that allows an authenticated user with the wpamelia-customer role or higher to force the GetEventAttendeesCommandHandler to deliver a CSV file containing every attendee’s personally identifiable information for any event on the site. The handler enforces only the broad amelia_read_events capability, without verifying that the user is an organizer or provider of the specified event. As a result, the data is exposed to users who lack ownership of the event, leading to a significant privacy breach and the risk of identity theft and misuse of payment and order information.

WordPress sites that have installed the Amelia Booking for Appointments and Events Calendar plugin by melograno, in any version up to and including 9.9.1. The issue is specific to the /report/event/attendees endpoint that serves attendee data.

The CVSS score of 7.5 indicates a high severity vulnerability that can lead to major privacy loss. No EPSS data is available, so the exact likelihood of exploitation is unknown, but the vulnerability is exploitable by any authenticated user with wpamelia-customer privileges or higher. The attacker does not need any special privileges beyond authenticated access and a known event ID. The vulnerability is not yet listed in the CISA KEV catalog.