CVE-2026-9055 Overview
CVE-2026-9055 is a privilege escalation vulnerability in the Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress. The flaw affects versions 8.0 through 9.6.2 and stems from insufficient validation of the attacker-controlled type parameter in the customer update endpoint. Unauthenticated attackers can elevate to the wpamelia-manager role, then create a provider entity linked to an administrator user ID and overwrite that administrator's password. The vulnerability is classified as Improper Privilege Management [CWE-269].
Critical Impact
Unauthenticated attackers can gain full WordPress administrator access on any site running a vulnerable Amelia Premium installation, resulting in complete site compromise.
Affected Products
- Amelia Premium plugin for WordPress version 8.0
- Amelia Premium plugin versions 8.x through 9.6.1
- Amelia Premium plugin version 9.6.2
Discovery Timeline
- 2026-09-02 - CVE-2026-9055 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-9055
Vulnerability Analysis
The Amelia Premium plugin exposes a customer update endpoint that fails to validate the type parameter supplied by the requester. An unauthenticated attacker submits a request setting type to manager while providing an externalId value of 0. The plugin then creates a new WordPress user account with the wpamelia-manager role instead of a standard customer.
Once the attacker holds manager-level access, the second stage of the chain abuses the provider management functionality. The attacker creates a provider entity and links it to an existing administrator user ID. The provider workflow permits password updates on the linked WordPress account, allowing the attacker to overwrite the administrator's password and log in with full privileges.
Root Cause
The root cause is missing role validation in the customer update handler. The endpoint trusts client-supplied role identifiers and does not verify that the caller is authorized to assign privileged roles. The provider-to-user linkage logic compounds the issue by permitting cross-account password modifications without ownership checks.
Attack Vector
Exploitation requires only network access to the WordPress site's public endpoints. No authentication, no user interaction, and no prior access are required. The attack proceeds in three steps: submit a crafted request to the customer update endpoint with type=manager and externalId=0, create a provider entity referencing an administrator's user ID, and issue a password update through the provider workflow to seize the administrator account.
No public proof-of-concept code is currently available. See the Wordfence Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-9055
Indicators of Compromise
- Unexpected WordPress user accounts holding the wpamelia-manager role, particularly accounts created without a corresponding administrator action.
- Recent password changes on administrator accounts that do not correlate with legitimate reset requests or login history.
- Amelia provider records linked to WordPress user IDs belonging to administrator-level accounts.
- HTTP POST requests to Amelia customer update endpoints containing type=manager and externalId=0 parameter values.
Detection Strategies
- Inspect the wp_users and wp_usermeta tables for accounts assigned the wpamelia-manager role and correlate creation timestamps against Amelia customer activity.
- Review web server access logs for anomalous POST requests to Amelia REST endpoints from unauthenticated sources.
- Audit Amelia provider records and flag any provider linked to a WordPress user with the administrator role.
Monitoring Recommendations
- Enable WordPress audit logging for user role changes and password resets on administrator accounts.
- Alert on new user registrations when the site does not permit public registration.
- Monitor outbound admin sessions from IP addresses that have no prior authenticated history with the site.
How to Mitigate CVE-2026-9055
Immediate Actions Required
- Update the Amelia Premium plugin to a version newer than 9.6.2 as soon as the vendor releases a patched build. Consult the WP Amelia Changelog for release notes.
- Audit all WordPress user accounts and remove any unrecognized accounts with the wpamelia-manager or administrator role.
- Force password resets on all administrator accounts and rotate WordPress secret keys in wp-config.php.
- Review Amelia provider entities and delete any provider record linked to an administrator user ID.
Patch Information
Refer to the WP Amelia Changelog for the fixed release version. The vendor advisory is tracked by the Wordfence Vulnerability Report.
Workarounds
- Temporarily disable the Amelia Premium plugin until the patched version is applied if immediate updates are not feasible.
- Restrict access to Amelia REST endpoints at the web application firewall (WAF) or reverse proxy layer, blocking unauthenticated requests that carry the type or externalId parameters.
- Limit access to the WordPress site's booking endpoints to known IP ranges where operationally acceptable.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
