The vulnerability is an Incorrect Privilege Assignment flaw that allows an attacker to elevate their privileges within a WordPress site where the Amelia booking plugin is installed. By exploiting this weakness, a non‑authoritative user can gain administrative or other privileged capabilities, potentially leading to complete compromise of the site’s configuration and data. The weakness is identified as CWE-266, indicating an improper assignment of security attributes.

The issue affects the Amelia plugin for WordPress from unspecified earlier releases through version 1.2.38. Users running any of these versions are susceptible.

The CVSS v3.1 score is 7.2, reflecting a fairly high severity. The EPSS score is below 1% and the vulnerability is not listed in CISA's KEV catalog, suggesting low current exploitation likelihood. Nevertheless, because the flaw leads to privilege escalation, any attacker who can reach the WordPress site and trigger the plugin’s privileged operations could exploit it. The likely attack vector is through the web interface of the site, possibly via crafted HTTP requests targeting the plugin’s endpoints.