The vulnerability in the Amelia Booking WordPress plugin allows a user to gain direct access to any user account’s password change functionality irrespective of the account’s role. An attacker who has authenticated access with customer-level permissions or higher can alter the password of any user, including administrators, which effectively enables account takeover and complete control over the site’s administrative functions.

Any WordPress installation that has the Amelia Booking plugin (Booking for Appointments and Events Calendar – Amelia) at version 9.1.2 or earlier is affected. This applies to all sites that have installed the plugin without upgrading to a later security‑patched release.

The flaw carries a CVSS score of 8.8, indicating a high severity level. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. The attack path requires the attacker to be authenticated and have at least customer-level privileges, after which they can call the plugin’s password‑change endpoint using arbitrary user identifiers. Because the underlying access control check is missing, the exploit is straightforward for anyone with access to the plugin’s authenticated interface. The combination of operational impact and ease of exploitation results in a high risk to affected sites.