Vulnerability · Published Jan 9, 2026 · Assigned by Wordfence
CVE-2025-14720Booking for Appointments and Events Calendar – Amelia <= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX Actions
Medium 5.3
In plain English
A medium-severity missing authorization in Booking for Appointments and Events Calendar – Amelia from ameliabooking. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Official description
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on multiple AJAX actions in all versions up to, and including, 1.2.38. This makes it possible for unauthenticated attackers to mark payments as refunded, trigger sending of queued notifications (emails/SMS/WhatsApp), and access debug information among other things.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ameliabooking | Booking for Appointments and Events Calendar – Amelia | 0 – through 1.2.38 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N