CVE-2026-5465: Amelia WordPress Plugin Auth Bypass Flaw

CVE-2026-5465 Overview

CVE-2026-5465 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] affecting the Booking for Appointments and Events Calendar – Amelia plugin for WordPress in all versions up to and including 2.1.3. The flaw resides in the UpdateProviderCommandHandler, which fails to validate changes to the externalId field when a Provider (Employee) user updates their own profile. Authenticated attackers holding Provider-level access can inject an arbitrary externalId mapping to any WordPress user ID, including the Administrator account. The plugin then passes that value to wp_set_password() and wp_update_user() without authorization checks, enabling full account takeover.

Critical Impact
Authenticated Provider users can take over any WordPress account — including Administrator — by manipulating the externalId field during a self-service profile update.

Affected Products

Booking for Appointments and Events Calendar – Amelia plugin for WordPress
All versions up to and including 2.1.3
WordPress sites with Provider (Employee) role accounts enabled

Discovery Timeline

2026-04-07 - CVE-2026-5465 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-5465

Vulnerability Analysis

The Amelia plugin exposes a provider self-update endpoint handled by UpdateProviderController and processed via UpdateProviderCommandHandler. When a Provider edits their own profile, the handler accepts client-supplied input including an externalId attribute. This externalId corresponds directly to a WordPress user identifier within the wp_users table.

The handler proceeds to call wp_set_password() and wp_update_user() against the supplied identifier without verifying that the authenticated Provider actually owns that WordPress user account. An attacker who already holds Provider-level access can therefore change another user's password and profile data, including users with the administrator role. The result is complete site takeover from a low-privilege starting point.

Root Cause

The root cause is missing authorization on a user-controlled object reference [CWE-639]. The plugin trusts the externalId value submitted with the update request rather than binding the update to the session's owning user. No capability check, ownership check, or nonce-bound identity verification is performed before privileged WordPress user functions are invoked.

Attack Vector

Exploitation requires an authenticated session with Provider (Employee) privileges or higher. The attacker submits a profile update request containing an externalId value matching the WordPress user ID of the target account, along with a new password. Because the request is processed over the standard plugin REST/AJAX surface, no user interaction from the victim is required. Implementation details of the vulnerable handler are documented in the Wordfence Vulnerability Analysis and the WordPress Amelia Booking Code Snippet.

// No verified exploit code is publicly available. See vendor changeset:
// https://plugins.trac.wordpress.org/changeset/3499608/ameliabooking/

Detection Methods for CVE-2026-5465

Indicators of Compromise

Unexpected password changes or profile modifications on WordPress Administrator accounts.
Requests to the Amelia provider update endpoint where the externalId value does not match the requesting Provider's mapped WordPress user ID.
New Administrator logins originating from IP addresses or user agents previously associated with low-privilege Provider accounts.
Audit log entries showing wp_set_password() invocations against high-privilege accounts after Provider activity.

Detection Strategies

Inspect WordPress request logs for Amelia provider update calls and correlate the submitted externalId against the authenticated session user.
Alert on any password reset event for privileged WordPress roles that follows a Provider profile update within a short time window.
Deploy a Web Application Firewall (WAF) rule that blocks or flags Amelia provider update requests containing an externalId parameter mismatch.

Monitoring Recommendations

Forward WordPress authentication, password change, and role assignment events to a centralized logging or SIEM platform.
Monitor the Amelia plugin version installed across managed WordPress estates and flag any instance at or below 2.1.3.
Track changes to the wp_users table and Amelia provider records for anomalous cross-account modifications.

How to Mitigate CVE-2026-5465

Immediate Actions Required

Update the Amelia plugin to the patched release published in the vendor changeset 3499608.
Audit all WordPress Administrator and high-privilege accounts for unexpected password resets or profile changes since the plugin was deployed.
Rotate passwords and force re-authentication for all Administrator-level WordPress users.
Review the list of Provider (Employee) accounts and remove any that are unrecognized or no longer required.

Patch Information

The Amelia development team addressed the issue by adding authorization validation to the UpdateProviderCommandHandler so the externalId field can no longer be modified to reference a WordPress user other than the authenticated Provider's own account. Site owners should upgrade to the version published in the vendor changeset referenced above. Additional technical context is available in the Wordfence Vulnerability Analysis.

Workarounds

If immediate patching is not possible, restrict the Provider (Employee) role to trusted users only and disable self-registration for that role.
Place the Amelia provider update endpoint behind a WAF rule that blocks requests where externalId differs from the authenticated user's mapped value.
Temporarily disable the Amelia plugin on sites where Provider self-service profile updates are not required.

bash

# Example: enumerate installed Amelia version via WP-CLI to identify vulnerable sites
wp plugin get ameliabooking --field=version

# Update to the patched release across managed sites
wp plugin update ameliabooking