Authorization Bypass in Booking for Appointments and Events Calendar Plugin by WordPress

CVE-2026-104992

What is CVE-2026-104992?

The Amelia plugin for WordPress contains a vulnerability that allows authenticated users with custom-level access or higher to bypass authorization checks. This flaw permits these users to export comprehensive CSV files of booking records for any event, regardless of their actual participation or ownership. The data extracted through this vulnerability includes sensitive information such as attendee names, email addresses, phone numbers, booking statuses, participant counts, payment details, and applied coupon codes. Consequently, this exposes a significant risk to user privacy and data security.

References