The Amelia booking plugin contains a logical flaw that bypasses token validation for appointments in a waiting state. An attacker who can send a crafted request to the public admin‑ajax endpoint can approve any such booking without authentication, effectively modifying scheduled events or generating unauthorized appointments. This weakness represents improper authorization (CWE‑285) and allows unauthenticated modification of data rather than code execution.

The vulnerability affects the WordPress plugin Booking for Appointments and Events Calendar – Amelia from all releases up to and including version 2.1.2. Users running any of those versions are susceptible; newer releases are assumed to be fixed.

The CVSS score of 5.3 classifies the issue as moderate but not trivial; no EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a simple HTTP request to the free admin‑ajax endpoint that triggers the approval action. Because the breach requires no authentication, an attacker can repeatedly exploit it until the target disables the endpoint or removes the waiting‑state logic.