CVE-2026-77705: Amelia Booking Plugin Auth Bypass Flaw

CVE-2026-77705 Overview

CVE-2026-77705 is a broken access control vulnerability in the Amelia Booking for Appointments and Events Calendar WordPress plugin before version 2.4.10. The plugin fails to verify that a user editing a customer or employee record is authorized to modify the WordPress account linked to that record. Attackers holding Amelia customer or employee management permissions can set the email address and password of arbitrary WordPress accounts. This allows takeover of higher-privileged accounts, including administrators, from a lower-privileged staff role. The issue is tracked as CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact

Authenticated attackers with Amelia manager permissions can hijack any WordPress account, including administrators, by rewriting the linked account credentials.

Affected Products

• Amelia — Booking for Appointments and Events Calendar WordPress plugin, versions prior to 2.4.10
• WordPress sites exposing Amelia customer or employee management roles to non-administrator staff
• Any account (including WordPress administrators) linked to an Amelia customer or employee record

Discovery Timeline

• 2026-09-12 - CVE-2026-77705 published to NVD
• 2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-77705

Vulnerability Analysis

The Amelia plugin links customer and employee records to underlying WordPress user accounts. When a staff member with Amelia management permissions edits one of these records, the plugin propagates changes to the linked wp_users account, including the email address and password. The plugin does not validate whether the acting user is authorized to modify the target WordPress account. Because WordPress uses the email address for password-reset flows, changing either the email or the password is sufficient to take over the account. An attacker with Amelia customer or employee manager privileges can therefore capture accounts belonging to higher-privileged users mapped to Amelia records.

Root Cause

The root cause is a missing authorization check on a user-controlled identifier ([CWE-639]). The plugin trusts the record identifier supplied by the requester and updates the linked WordPress account without confirming the requester's WordPress-level capability to edit that account. Amelia role permissions are treated as sufficient authority over the underlying WordPress identity, conflating plugin-level roles with WordPress capability checks such as edit_user.

Attack Vector

The attack requires an authenticated session with Amelia customer or employee management permissions. The attacker edits a customer or employee record whose linked WordPress user has higher privileges, such as an administrator. By submitting a new email address or password through the record edit endpoint, the attacker rewrites the credentials on the target WordPress account. The attacker then authenticates as the target user or triggers a password reset to the attacker-controlled email. No user interaction from the victim is required. See the WPScan Vulnerability Report for additional detail.

Detection Methods for CVE-2026-77705

Indicators of Compromise

• Unexpected changes to the user_email or user_pass fields in the wp_users table for administrator or editor accounts.
• WordPress password-reset emails delivered to previously unseen or external addresses linked to privileged accounts.
• Amelia audit or debug logs showing customer or employee record edits that target records mapped to high-privilege WordPress users.
• New administrator logins from IP addresses associated with lower-privileged Amelia staff accounts.

Detection Strategies

• Compare current wp_users.user_email values against historical backups to identify silent email rewrites.
• Alert on HTTP POST requests to Amelia AJAX endpoints (admin-ajax.php with action=wpamelia_api) that modify customer or employee records and include email or password parameters.
• Correlate Amelia record edits performed by non-administrator sessions with subsequent WordPress administrator logins from the same source IP.

Monitoring Recommendations

• Enable WordPress audit logging for user profile modifications and password changes across all roles.
• Monitor outbound mail for password-reset messages sent to addresses outside the organization's approved domains.
• Review Amelia role assignments and flag any non-administrator account granted customer or employee management permissions.

How to Mitigate CVE-2026-77705

Immediate Actions Required

• Update the Amelia plugin to version 2.4.10 or later on all WordPress sites.
• Audit WordPress administrator and editor accounts for unauthorized email or password changes and force password resets where necessary.
• Revoke Amelia customer and employee management permissions from any account that does not require them.
• Rotate credentials and review recent login activity for accounts linked to Amelia records.

Patch Information

The vendor fixed the missing authorization check in Amelia version 2.4.10. Upgrade through the WordPress plugin manager or WP-CLI. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

• Restrict Amelia customer and employee management capabilities to trusted WordPress administrators until the patch is applied.
• Unlink WordPress administrator accounts from Amelia customer or employee records to remove the takeover path.
• Place the /wp-admin/admin-ajax.php endpoint behind IP allowlisting or a Web Application Firewall rule that blocks Amelia record-edit actions from non-administrator sessions.