A missing authorization flaw in the TMS Amelia ameliabooking WordPress plugin removes essential access controls, allowing attackers to bypass the intended security levels and potentially out tasks carried out by legitimate users. The vulnerability is classified as CWE‑862, indicating a direct loss of authorization checks that can lead to the unauthorized manipulation of booking data and user information.

WordPress sites that employ the Amelia booking plugin, specifically all releases through version 2.4.10. Users of older versions of the plugin are also at risk because the issue exists from the earliest releases up to 2.4.10 inclusive.

The CVSS score of 5.3 places this issue in the moderate severity range, and the EPSS score is unavailable, so exact exploitation probability is unknown. The vulnerability is not currently listed in CISA's KEV catalog, suggesting no widespread exploitation has been observed yet. The likely attack vector is remote, via web requests to the plugin’s administration endpoints that are improperly protected by authorization checks. Exploitation would require either a user with some level of access to the WordPress installation or the ability to forge requests that target the vulnerable plugin APIs.