{"id":"CVE-2026-2931","aliases":["EUVD-2026-16095","GHSA-cfxx-jfwh-m66r"],"status":"published","title":"Amelia Booking \u003c= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change","description":"The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 9.1.2. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated attackers with customer-level permissions or above to change user passwords and potentially take over administrator accounts. The vulnerability is in the pro plugin, which has the same slug.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00487,"percentile":0.4219,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-269"],"published":"2026-03-26T03:37:28Z","modified":"2026-06-17T10:32:03Z","exploits":[{"source":"pocgithub","id":"htrxuan/hdwebmobile-booking-appointments","title":"htrxuan/hdwebmobile-booking-appointments","date":"2026-09-08","url":"https://github.com/htrxuan/hdwebmobile-booking-appointments"}],"products":[{"vendor":"ameliabooking","product":"booking for appointments and events calendar – amelia"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dbaafbb-ab7b-41d8-a8f7-178b9d42b4c5?source=cve"},{"url":"https://codecanyon.net/item/amelia-enterpriselevel-appointment-booking-wordpress-plugin/22067497"},{"url":"https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.1/src/Application/Controller/User/Customer/UpdateCustomerController.php#L30"},{"url":"https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.1/src/Application/Commands/User/Customer/UpdateCustomerCommandHandler.php#L173"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2931"},{"url":"https://github.com/advisories/GHSA-cfxx-jfwh-m66r"}],"sources":{"cve":[{"id":"CVE-2026-2931","title":"Amelia Booking \u003c= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change","description":"The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 9.1.2. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated attackers with customer-level permissions or above to change user passwords and potentially take over administrator accounts. The vulnerability is in the pro plugin, which has the same slug.","status":"published","published":"2026-03-26T03:37:28.098Z","modified":"2026-04-08T17:11:38.336Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T13:48:35.749498Z"}],"euvd":[{"id":"EUVD-2026-16095","description":"The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 9.1.2. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated attackers with customer-level permissions or above to change user passwords and potentially take over administrator accounts. The vulnerability is in the pro plugin, which has the same slug.","status":"published","published":"2026-03-26T03:37:28Z","modified":"2026-04-08T17:11:38Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:24:47.565697Z"}],"ghsa":[{"id":"GHSA-cfxx-jfwh-m66r","title":"The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in...","description":"The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 9.1.2. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated attackers with customer-level permissions or above to change user passwords and potentially take over administrator accounts. The vulnerability is in the pro plugin, which has the same slug.","status":"published","published":"2026-03-26T06:30:21Z","modified":"2026-03-26T06:30:27Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:06:52.37988Z"}],"nvd":[{"id":"CVE-2026-2931","description":"The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 9.1.2. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated attackers with customer-level permissions or above to change user passwords and potentially take over administrator accounts. The vulnerability is in the pro plugin, which has the same slug.","status":"published","published":"2026-03-26T05:16:39.03Z","modified":"2026-06-17T10:32:03.6Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:12:11.678711Z"}]}}