Is CVE-2026-107616 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107616 being exploited in the wild.

How severe is CVE-2026-107616?

High severity, with a CVSS score of 7.5, published 7 November 2026.

Which products and versions are affected?

Elfsight Amelia up to and including 9.9.1.

Is there a fix for CVE-2026-107616?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-107616 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107616?

Check whether you run Elfsight Amelia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107616: Amelia plugin for WordPress unauthorized attendee data access

CVE-2026-107616 · Severity: high · CVSS 7.5 · Published 2026-11-07

The Amelia plugin for WordPress is a booking and event management system used by businesses and service providers. Authenticated users with basic customer-level access can bypass authorization checks to download complete attendee records—including names, emails, phone numbers, dates of birth, payment details, and uploaded files—for any event on the site, enabling data theft and privacy violations.

Vendors: Elfsight.

Quick answers

Is CVE-2026-107616 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107616 being exploited in the wild.
How severe is CVE-2026-107616?: High severity, with a CVSS score of 7.5, published 7 November 2026.
Which products and versions are affected?: Elfsight Amelia up to and including 9.9.1.
Is there a fix for CVE-2026-107616?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-107616 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107616?: Check whether you run Elfsight Amelia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The GetEventAttendeesCommandHandler::handle() function in Amelia up to version 9.9.1 fails to verify that an authenticated user is the organizer or provider of a requested event, checking only the broad `amelia_read_events` capability that the `wpamelia-customer` role already possesses. An attacker can exploit this by calling the `/report/event/attendees` endpoint with an arbitrary event ID to export a full CSV of sensitive personal identifiable information. The vulnerability requires authentication but affects any user with customer-level access or above.

Affected products

Elfsight Amelia up to and including 9.9.1

Timeline

2026-11-07: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.