The Amelia plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to 2.1.3. The UpdateProviderCommandHandler does not check whether the `externalId` field being updated belongs to the currently authenticated Provider user. Because `externalId` is directly mapped to a WordPress user ID and is passed to wp_set_password() and wp_update_user() without authorization checks, an authenticated Provider can set the field to any numeric value. The affected system then resets the password and updates the user profile of the target account. This allows the attacker to take over any WordPress account, including administrators.

All releases of the Amelia Booking for Appointments and Events Calendar plugin for WordPress up to and including version 2.1.3 are affected. The vulnerability exists in the plugin code that handles Provider profile updates. The issue applies to any WordPress installation that uses the Amelia plugin where a Provider (or more privileged user) can log in and edit their provider profile.

The CVSS score of 8.8 indicates a high severity. Exploitation requires the attacker to be an authenticated Provider user or higher, and to access the provider profile update feature. Once authenticated, the attacker can simply submit a payload containing an arbitrary externalId equal to the numeric WordPress user ID of the target account. Because the plugin forwards this value to core WordPress functions without permission checks, no additional privileges or software features are needed. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the lack of authorization checks means that any Provider-level user can immediately take ownership of any account, posing a significant risk to site integrity and confidentiality.