Vulnerability · Published Nov 7, 2026 · Assigned by Wordfence
CVE-2026-104992Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Authenticated (Custom+) Sensitive Information Disclosure via '/report/event/bookings' Endpoint
Medium 6.5
In plain English
A medium-severity missing authorization in Booking for Appointments and Events Calendar – Amelia from melograno. There are no confirmed reports of exploitation so far.
Official description
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.9.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to export a full CSV of booking records for any event on the site — including attendee names, email addresses, phone numbers, booking status, number of persons, price, payment status, payment amount, and coupon codes — regardless of whether they own or participate in those events.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| melograno | Booking for Appointments and Events Calendar – Amelia | 9.0 – through 9.9.1 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4536c41c-dc05-4384-80f4-49c3197965b1?source=cve
- https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Application/Commands/Report/GetEventBookingsCommandHandler.php#L41
- https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Application/Controller/Report/GetEventBookingsController.php#L36
- https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Infrastructure/Routes/Report/Report.php#L42
- https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/ameliabooking.php#L1336
- https://wpamelia.com/documentation/changelog/