The vulnerability stems from a broken access control flaw in versions of the WordPress Amelia plugin up to 2.2 (CWE‑862). It allows logged‑in users with the subscriber role to bypass permission checks that are intended to be reserved for administrators. The likely impact is unauthorized access to protected resources or functions within the plugin, potentially exposing sensitive data or enabling operations that elevate the user’s privileges (inferred).

WordPress sites using the Amelia booking plugin, versions 2.2 or earlier. The issue is resolved in plugin version 2.2.1 and later.

The Common Vulnerability Scoring System assigns a 6.5 score, indicating a moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely exploitation would require a web‑based attack in which the attacker is a legitimate subscriber to the site. Once authenticated, the attacker could send crafted requests to endpoints protected by the missing validation to gain unauthorized access (inferred).