Vulnerability · Published Nov 7, 2026 · Assigned by Wordfence

CVE-2026-107616Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure via '/report/event/attendees' Endpoint

High 7.5

In plain English

A high-severity missing authorization in Booking for Appointments and Events Calendar – Amelia from melograno. There are no confirmed reports of exploitation so far.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)–no EPSS score yet

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The Amelia plugin for WordPress is vulnerable to unauthorized access of attendee data due to a missing authorization check on the GetEventAttendeesCommandHandler::handle() function in versions up to, and including, 9.9.1. The handler only enforces the broad `amelia_read_events` capability — which the plugin's own `wpamelia-customer` role possesses — and does not verify that the authenticated user is an organizer/provider of the event referenced by the client-supplied `id` query parameter. This makes it possible for authenticated attackers, with wpamelia-customer-level access and above, to export the full CSV of attendee personally identifiable information (first/last name, email, phone, date of birth, gender, private notes, payment amounts/methods, WooCommerce order IDs, custom-field values, and uploaded-file URLs) for any Amelia event on the site by directly invoking the `/report/event/attendees` endpoint with an arbitrary event ID.

Affected products (as reported)

Vendor	Product	Versions
melograno	Booking for Appointments and Events Calendar – Amelia	9.0 – through 9.9.1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In plain English

Official description

Affected products (as reported)

References