CVE-2026-5465: Amelia WordPress Plugin Auth Bypass Flaw

CVE-2026-5465 Overview

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in all versions up to and including 2.1.3. The vulnerability exists in the UpdateProviderCommandHandler component, which fails to properly validate changes to the externalId field when a Provider (Employee) user updates their own profile. Since the externalId maps directly to a WordPress user ID and is subsequently passed to wp_set_password() and wp_update_user() without proper authorization checks, authenticated attackers with Provider-level access can inject an arbitrary externalId value to take over any WordPress account, including Administrator accounts.

Critical Impact

Authenticated attackers with Provider-level (Employee) access can escalate privileges and take over any WordPress account, including Administrator accounts, leading to complete site compromise.

Affected Products

• Booking for Appointments and Events Calendar – Amelia plugin for WordPress versions up to and including 2.1.3

Discovery Timeline

• 2026-04-07 - CVE-2026-5465 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-5465

Vulnerability Analysis

This vulnerability is classified as CWE-639: Authorization Bypass Through User-Controlled Key (Insecure Direct Object Reference). The flaw resides in the provider profile update functionality within the Amelia booking plugin. When a provider user submits a profile update request, the application accepts user-controlled values for the externalId field without verifying that the authenticated user has authorization to modify data associated with that external ID.

The externalId field serves as a foreign key reference to WordPress user accounts. By manipulating this value during a profile update, an attacker can cause the application to invoke privileged WordPress functions (wp_set_password() and wp_update_user()) against arbitrary user accounts. This enables a relatively low-privileged Provider account to reset passwords and modify user details for any WordPress user, including site administrators.

The vulnerability requires network access and authentication with at least Provider-level permissions. No user interaction is required for exploitation, and successful attacks result in complete compromise of confidentiality, integrity, and availability of the targeted WordPress user account.

Root Cause

The root cause is a missing authorization check in the UpdateProviderCommandHandler.php file. The handler accepts the externalId parameter from user input and uses it directly in security-sensitive WordPress functions without validating that the authenticated user owns or has permission to modify the referenced WordPress user account. The affected code can be reviewed in the WordPress Code Review at Line 146 and subsequent lines.

Attack Vector

The attack is executed over the network by an authenticated user with Provider (Employee) level access to the WordPress site. The attacker exploits the provider profile update endpoint by injecting a malicious externalId value corresponding to a target WordPress user (such as an administrator). When the request is processed, the application updates the target user's credentials without performing authorization verification, effectively allowing the attacker to take over the account by setting a known password.

The vulnerability mechanism involves the following steps: An authenticated Provider user accesses their profile update functionality, then modifies the request payload to include an externalId value corresponding to a different WordPress user account. The UpdateProviderCommandHandler processes this request and passes the attacker-controlled externalId to wp_set_password() and wp_update_user(), which then update the targeted user's account. Technical details are available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-5465

Indicators of Compromise

• Unexpected password reset events for administrator or privileged user accounts without corresponding user-initiated actions
• Audit log entries showing provider profile updates with externalId values that differ from the authenticated user's WordPress user ID
• New or modified administrator accounts created or altered by non-administrative users
• Unusual login activity or session creation for privileged accounts following Amelia plugin API calls

Detection Strategies

• Monitor WordPress authentication logs for password changes on administrator accounts that correlate with Amelia provider profile update requests
• Implement application-level logging to capture externalId parameter values in provider update requests and flag discrepancies between the authenticated user and the referenced ID
• Deploy web application firewall (WAF) rules to detect anomalous externalId values in requests to the Amelia provider update endpoint
• Utilize SentinelOne Singularity to detect post-exploitation activity such as unauthorized administrative access or configuration changes

Monitoring Recommendations

• Enable detailed logging for WordPress user management functions including wp_set_password() and wp_update_user()
• Configure alerting for any changes to administrator account credentials or privileges
• Review Amelia plugin access logs regularly for provider profile update activity targeting unexpected user IDs
• Implement real-time monitoring of WordPress authentication events using SentinelOne endpoint protection

How to Mitigate CVE-2026-5465

Immediate Actions Required

• Update the Amelia plugin to a patched version beyond 2.1.3 immediately
• Review WordPress user accounts for unauthorized modifications, especially administrator accounts
• Reset passwords for all administrator accounts if compromise is suspected
• Temporarily disable Provider-level user accounts until the patch is applied
• Audit recent provider profile update activity in application logs

Patch Information

A security patch addressing this vulnerability is available in the WordPress plugin repository. The fix implements proper authorization checks to ensure that provider users can only modify externalId values corresponding to their own WordPress accounts. The remediation changes can be reviewed in WordPress Changeset #3499608.

Workarounds

• If immediate patching is not possible, restrict Provider (Employee) account creation and limit existing Provider accounts to trusted users only
• Implement network-level access controls to limit access to WordPress administrative functions from untrusted networks
• Deploy a web application firewall with rules to sanitize or block requests containing suspicious externalId parameter manipulation
• Consider temporarily disabling the Amelia plugin provider profile update functionality until the patch can be applied

# Example: Temporarily disable Amelia plugin via WP-CLI
wp plugin deactivate ameliabooking --allow-root

# Re-enable after updating to patched version
wp plugin update ameliabooking --allow-root
wp plugin activate ameliabooking --allow-root