Executive brief
Amelia is a WordPress plugin for managing bookings and appointments. The plugin fails to properly authenticate requests for post-booking actions, allowing an attacker to trigger booking confirmations, SMS/WhatsApp notifications, and webhook callbacks for any booking without authorization, potentially enabling spam, notification abuse, and credential exfiltration via webhook callbacks carrying sensitive booking data.
Technical details
The vulnerability is a broken access control (CWE-862) flaw in the post-booking action chain handler. The plugin's `/bookings/success/{id}` endpoint does not properly validate authentication or request legitimacy before executing post-booking notifications and integrations. An unauthenticated attacker can extract a valid nonce by making an anonymous request to `/bookings`, then use that nonce to trigger the action chain for any booking by enumerating payment identifiers. The attacker can re-fire notifications multiple times by specifying different payment IDs, and achieve impact through SMS/WhatsApp spam, webhook callback abuse to exfiltrate booking data, and notification flooding. The vulnerability is fixed in version 2.4.9.
Affected products
- WP Amelia Amelia before 2.4.9
Timeline
- 2026-08-31: disclosed
- 2026-02-04: patched: version 2.4.9
- 2026-09-02: advisory