Executive brief
Amelia Pro is a WordPress plugin for managing appointments, events, and bookings. The plugin fails to verify that payment was actually processed before marking appointments as paid, allowing unauthenticated attackers to book and confirm appointments without paying anything. This means a business could lose revenue on all bookings made through the plugin, and customers could fraudulently obtain services without payment.
Technical details
The vulnerability is an authentication and authorization bypass (CWE-284) in the booking endpoint. When processing a booking request, the plugin trusts the payment gateway name specified in an unauthenticated POST request to the AJAX endpoint without verifying that the gateway is actually configured on the site or that payment was genuinely processed. An attacker can send a crafted JSON payload specifying any payment gateway (e.g., PayPal) and the booking is recorded as paid and approved immediately, before payment validation occurs. The commit happens before the payment stage, so even when the payment eventually fails, the booking remains in the database. The endpoint is publicly accessible without authentication, and no user interaction is required beyond crafting the POST request.
Affected products
- AmeliaBooking Amelia Pro 9.0 through 9.8
Timeline
- 2026-09-10: disclosed
- 2026-09-12: advisory
- 2026-09-12: patched: Fixed in version 9.8.1