Security Advisory

CVE-2026-6449

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-02 07:46:40

Last updated 2026-05-04 15:01:09

Assigner Wordfence

CVSS score 5.3

State PUBLISHED

Description

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 2.1.2. This is due to a logical short-circuit flaw in authorization logic that causes token validation to be entirely skipped when a booking has a 'waiting' status. This makes it possible for unauthenticated attackers to approve any booking that is in 'waiting' status by sending a crafted request to the publicly-accessible admin-ajax endpoint.

← Browse all CVEs View on cve.org ↗