The vulnerability stems from a missing authorization check in the Amelia booking plugin for WordPress. Because access control security levels are incorrectly configured, an attacker can exploit the flaw to perform operations or view data that should be protected. This leads to unauthorized modification or disclosure of booking information, potentially compromising sensitive user details. The weakness aligns with CWE-862 – Missing Authorization.

All installations of the Amelia booking plugin for WordPress with versions up through 2.4.10 are vulnerable. The vendor is TMS:Amelia. Administrators should audit any site running these versions.

The CVSS score of 5.3 indicates a moderate impact. No EPSS score was provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of widespread exploitation. The attack vector is not detailed in the description, but because the flaw occurs in a WordPress plugin, it is likely exploitable by an authenticated user who can access the plugin’s interfaces. Organizations should assume that the exploit could lead to unauthorized access to appointment data or administrative functions.