Skip to content
OpenAdvisories

Vendor

ameliabooking

20 known vulnerabilities.

Products

Booking for Appointments and Events Calendar – Amelia 13 Amelia 4 Booking System Trafft 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.8
    CVE-2026-5465 Public exploit

    Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter

    The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.3. This is due to the `UpdateProviderCommandHandler` failing to validate changes to the …

    ameliabooking Booking for Appointments and Events Calendar – Amelia Web / CMS
  • High 8.8
    CVE-2026-2931 Public exploit

    Amelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change

    The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 9.1.2. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system re…

    ameliabooking Booking for Appointments and Events Calendar – Amelia Web / CMS