CVE-2024-6332: Amelia WordPress Plugin Auth Bypass Flaw

CVE-2024-6332 Overview

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress contains a missing authorization vulnerability [CWE-862] in the ameliaButtonCommand function. The flaw affects Amelia Premium versions up to and including 7.7 and Amelia Lite versions up to and including 1.2.4. Unauthenticated attackers can access employee calendar details through the vulnerable function. In the Premium edition, the exposure extends to Google Calendar OAuth tokens, which enables attackers to read connected calendar data outside the WordPress environment. The vulnerability was published to the National Vulnerability Database on September 5, 2024.

Critical Impact
Unauthenticated attackers can retrieve employee calendar data and, in Premium installations, Google Calendar OAuth tokens usable to access external calendar accounts.

Affected Products

Amelia Premium for WordPress — versions up to and including 7.7
Amelia Lite for WordPress — versions up to and including 1.2.4
Vendor: tmsproducts

Discovery Timeline

2024-09-05 - CVE-2024-6332 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6332

Vulnerability Analysis

The vulnerability is a missing capability check in the ameliaButtonCommand function exposed by the Amelia booking plugin. WordPress plugins commonly register AJAX or admin-post handlers that must verify the caller's role or capability before returning privileged data. In this case, the handler processes requests without enforcing an authorization check, so any HTTP client reaching the endpoint receives a response. The functional impact is direct information disclosure of employee calendar records. In Amelia Premium, the same code path returns Google Calendar OAuth tokens stored by the plugin to integrate staff calendars. An attacker holding those tokens can query the Google Calendar API on behalf of the connected account, expanding the impact beyond the WordPress site.

Root Cause

The root cause is an authorization gap in server-side request handling. The ameliaButtonCommand handler lacks a current_user_can() capability check and does not gate access behind an authenticated session or nonce validation appropriate for the sensitivity of the returned data. Reference implementations of the handler are visible in the plugin's TinyMCE integration files at assets/js/tinymce/amelia-mce.js and public/js/tinymce/amelia-mce.js (see WordPress Amelia Booking JS).

Attack Vector

The attack vector is remote and network-based, requires no authentication, and requires no user interaction. An attacker sends a crafted HTTP request to the WordPress site targeting the ameliaButtonCommand action. The server processes the request and returns employee calendar details in the response body. On Premium installations, the response includes stored Google Calendar OAuth tokens tied to staff accounts. Refer to the Wordfence Vulnerability Analysis for additional technical details.

Detection Methods for CVE-2024-6332

Indicators of Compromise

Unauthenticated HTTP POST or GET requests to admin-ajax.php or plugin endpoints invoking the ameliaButtonCommand action.
Access log entries showing high-volume requests to Amelia plugin endpoints from a single source IP with no prior authenticated session.
Unexpected Google Calendar API activity on staff accounts linked to the WordPress installation, such as reads from unfamiliar IP ranges.

Detection Strategies

Inspect WordPress access logs for requests containing the ameliaButtonCommand parameter or action name and correlate with the absence of a valid wordpress_logged_in_* cookie.
Enable WordPress debug logging or use a web application firewall to record and alert on requests targeting Amelia AJAX handlers from unauthenticated sessions.
Baseline normal usage of the plugin endpoints and alert on deviations in request rate, source geography, or user-agent strings.

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform and build queries for Amelia-specific request patterns.
Monitor the Google Workspace or Google Cloud audit logs for OAuth token usage originating from IP addresses outside the WordPress server.
Track plugin version inventory across WordPress fleets to identify unpatched Amelia Premium and Lite installations.

How to Mitigate CVE-2024-6332

Immediate Actions Required

Upgrade Amelia Premium to a version later than 7.7 and Amelia Lite to a version later than 1.2.4 as published by tmsproducts.
Revoke and reissue any Google Calendar OAuth tokens configured in the plugin, since exposed tokens remain valid until revoked at the Google account level.
Audit web server access logs for prior exploitation attempts against the ameliaButtonCommand handler.

Patch Information

The vendor tmsproducts addresses the missing authorization check in Amelia Premium releases after 7.7 and Amelia Lite releases after 1.2.4. Administrators should apply the update through the WordPress plugin update mechanism. Confirm the installed version in the WordPress admin plugins page after the update. Refer to the Wordfence Vulnerability Analysis for vendor references.

Workarounds

Deploy a web application firewall rule that blocks unauthenticated requests targeting the ameliaButtonCommand action until the plugin is updated.
Temporarily disable the Amelia plugin on sites that cannot be patched immediately, particularly Premium installations with Google Calendar integrations.
Rotate all OAuth credentials associated with the plugin and restrict Google Cloud OAuth client redirect URIs to trusted hosts.

bash

# Example WAF rule pattern (ModSecurity syntax) to block unauthenticated access
SecRule REQUEST_URI "@contains admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1006332,msg:'Block unauth Amelia ameliaButtonCommand'"
  SecRule ARGS "@contains ameliaButtonCommand" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"