The Amelia booking plugin for WordPress contains a missing authorization flaw that allows attackers to bypass configured access controls. Exploiting this vulnerability enables an attacker to read, modify, or delete booking data and related configuration, leading to unauthorized data exposure or integrity compromise. The weakness is identified as CWE-862, indicating improper enforcement of access restrictions.

Vulnerabilities exist in the Amelia plugin developed by ameliabooking, affecting any WordPress site that has the plugin installed with version 1.2.38 or earlier. Site administrators should verify the current plugin version and consider whether default or custom roles grant excessive privileges to the plugin’s operations.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The flaw is not yet listed in CISA’s KEV catalog, and no publicly known exploits are documented. Based on the description, the likely attack vector is through an unauthenticated or low‑privileged user interacting with the plugin’s front‑end or back‑end interfaces, enabling a privilege escalation that performs actions normally reserved for administrators or staff.