Executive brief
Amelia Pro is a WordPress plugin for managing appointments, schedules, and employee accounts. The plugin's Employee Panel allows any authenticated employee to change another employee's cabinet password without authorization, enabling account takeover and unauthorized access to booking data and customer personal information.
Technical details
This is an insecure direct object reference (IDOR) vulnerability in the provider account update endpoint (/users/providers/PROVIDER_ID). An authenticated employee (provider) can send a password change request using a stolen or known provider ID without the application verifying ownership of that account. The vulnerability is triggered when the email field is omitted from the request; including an email field triggers an "Email already exist" validation that blocks the attack. An authenticated attacker can fully compromise another provider's Employee Panel account and access their schedule, bookings, and customers' personal data.
Affected products
- AmeliaBooFing Amelia Pro before 9.8
Timeline
- 2026-08-24: disclosed
- 2026-08-26: advisory