CVE-2026-109684: Amelia Booking Auth Bypass Vulnerability

CVE-2026-109684 Overview

CVE-2026-109684 is a missing authorization vulnerability in the TMS Amelia (ameliabooking) WordPress plugin. The flaw affects all versions of Amelia up to and including 2.4.10. Attackers can exploit incorrectly configured access control security levels to interact with functionality that should require authentication or elevated privileges. The issue is classified under CWE-862: Missing Authorization.

The vulnerability is network-exploitable without user interaction and requires no authentication. Successful exploitation results in limited integrity impact against affected WordPress sites running the plugin.

Critical Impact

Unauthenticated remote attackers can invoke plugin actions that lack proper authorization checks, enabling tampering with booking data on sites running Amelia 2.4.10 or earlier.

Affected Products

• TMS Amelia ameliabooking WordPress plugin
• All versions from initial release through 2.4.10
• WordPress sites with Amelia installed and active

Discovery Timeline

• 2026-10-13 - CVE-2026-109684 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109684

Vulnerability Analysis

The Amelia booking plugin exposes functionality through WordPress AJAX and REST endpoints that handle appointment, event, and customer data. One or more of these endpoints fail to enforce proper authorization checks before executing privileged actions. The access control configuration treats requests as sufficiently authorized when they should be gated behind capability or role checks.

Because the attack vector is network-based and requires no privileges or user interaction, any remote actor who can reach the WordPress site can invoke the affected endpoints. The impact is scoped to integrity, meaning attackers can alter data but cannot directly extract confidential information or crash the service through this flaw. Further technical specifics are documented in the Patchstack Vulnerability Report.

The EPSS score is 0.184%, reflecting low observed exploitation probability at publication. No public proof-of-concept or active exploitation has been reported.

Root Cause

The root cause is a missing authorization check on plugin endpoints. The plugin registers callbacks that execute sensitive operations without first verifying the requester's WordPress capability, nonce validity in a security-relevant context, or user role. This permits callers to reach code paths intended only for authorized users.

Attack Vector

An attacker sends crafted HTTP requests to the vulnerable Amelia endpoint on a target WordPress site. The request does not require session cookies, API keys, or administrative credentials. The server processes the request and executes the underlying action, producing an integrity impact on booking-related data. The vulnerability mechanism is described in prose only; no verified public exploit code is available.

Detection Methods for CVE-2026-109684

Indicators of Compromise

• Unexpected creation, modification, or deletion of appointments, events, services, or customer records in the Amelia database tables.
• HTTP requests to admin-ajax.php or Amelia REST routes (/wp-json/amelia/*) originating from unauthenticated sources at anomalous volumes.
• WordPress audit log entries showing Amelia actions without a corresponding authenticated user session.

Detection Strategies

• Inventory WordPress installations and identify sites running Amelia at version 2.4.10 or earlier.
• Review web server access logs for POST requests to Amelia AJAX actions originating from external IPs lacking valid session cookies.
• Correlate plugin database writes with authenticated administrator sessions to surface unauthorized modifications.

Monitoring Recommendations

• Enable WordPress activity logging with a plugin that captures AJAX and REST invocations, including source IP and user context.
• Forward web server and WordPress logs to a centralized SIEM for retention and query against unauthenticated plugin activity.
• Alert on bursts of requests to Amelia endpoints that return HTTP 200 without prior authentication requests.

How to Mitigate CVE-2026-109684

Immediate Actions Required

• Update the Amelia plugin to a version later than 2.4.10 as soon as the vendor publishes a fixed release.
• Audit Amelia booking data for unauthorized changes made since the plugin was installed or last patched.
• Restrict administrative and booking endpoints behind a web application firewall (WAF) with virtual patching rules for Patchstack-reported Amelia vulnerabilities.

Patch Information

Refer to the Patchstack Vulnerability Report for the current patch status. The advisory lists affected versions through 2.4.10. Apply the vendor-released fixed version through the WordPress plugin updater once available.

Workarounds

• Temporarily deactivate the Amelia plugin on sites where immediate patching is not feasible.
• Deploy WAF rules that block unauthenticated POST requests to known Amelia AJAX actions and REST routes.
• Restrict access to /wp-admin/admin-ajax.php and /wp-json/amelia/* by IP allowlist where booking functionality is only required internally.

# Example: block unauthenticated access to Amelia REST routes at the web server (nginx)
location ~ ^/wp-json/amelia/ {
    allow 10.0.0.0/8;
    deny all;
}