Unauthorized Access Vulnerability in Amelia Plugin for WordPress

CVE-2026-107616

What is CVE-2026-107616?

The Amelia plugin for WordPress contains a serious vulnerability that permits unauthorized access to attendee data. Due to a deficiencies in the authorization checks within the GetEventAttendeesCommandHandler::handle() function, attackers who possess the wpamelia-customer role and higher can exploit this issue to extract sensitive information. By invoking the '/report/event/attendees' endpoint with a specific event ID, authenticated users may gain unlawful access to personal identifiable information (PII) of attendees across any event hosted through the Amelia plugin. This includes sensitive data such as names, emails, phone numbers, dates of birth, gender, private notes, payment information, and WooCommerce order IDs.

References