# CVE-2026-14215: Amelia WordPress plugin unauthenticated post-booking action trigger

Source: https://junglewise.ai/threats/cve-2026-14215-amelia-wordpress-plugin-unauthenticated-post-booking-action  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-14215 · Severity: medium · CVSS 6.5 · Published 2026-09-02

Amelia is a WordPress plugin for managing bookings and appointments. The plugin fails to properly authenticate requests for post-booking actions, allowing an attacker to trigger booking confirmations, SMS/WhatsApp notifications, and webhook callbacks for any booking without authorization, potentially enabling spam, notification abuse, and credential exfiltration via webhook callbacks carrying sensitive booking data.

## Quick answers

**Is CVE-2026-14215 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14215 being exploited in the wild.

**How severe is CVE-2026-14215?** Medium severity, with a CVSS score of 6.5, published 2 September 2026.

**Which products and versions are affected?** WP Amelia Amelia before 2.4.9.

**Is there a fix for CVE-2026-14215?** A patch was published on 2026-02-04: version 2.4.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14215 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-14215?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a broken access control (CWE-862) flaw in the post-booking action chain handler. The plugin's `/bookings/success/{id}` endpoint does not properly validate authentication or request legitimacy before executing post-booking notifications and integrations. An unauthenticated attacker can extract a valid nonce by making an anonymous request to `/bookings`, then use that nonce to trigger the action chain for any booking by enumerating payment identifiers. The attacker can re-fire notifications multiple times by specifying different payment IDs, and achieve impact through SMS/WhatsApp spam, webhook callback abuse to exfiltrate booking data, and notification flooding. The vulnerability is fixed in version 2.4.9.

## Affected products

- WP Amelia Amelia before 2.4.9

## Timeline

- 2026-08-31: disclosed
- 2026-02-04: patched: version 2.4.9
- 2026-09-02: advisory

## References

- [https://wpscan.com/vulnerability/1d4c8417-59e3-41ed-91c0-283133f6cc22/](https://wpscan.com/vulnerability/1d4c8417-59e3-41ed-91c0-283133f6cc22/)