The Amelia Booking plugin for WordPress is subject to a critical privilege management vulnerability that allows authenticated users to escalate privileges and compromise administrator accounts.

This is an Insecure Direct Object Reference vulnerability (CWE-269) located in the customer update controller. It allows any authenticated user with customer-level permissions or higher to bypass authorization checks and modify sensitive user account details, including passwords.

The ability for a low-privileged customer to reset administrative passwords constitutes a total compromise of the WordPress environment. Given the CVSS score of 8.8, this vulnerability poses a severe risk to data integrity, confidentiality, and overall platform availability. Unauthorized account takeover can lead to unauthorized data access, malicious plugin installation, and complete site defacement or takeover.

Immediate Action: Update the Amelia Booking plugin to version 9.1.3 or higher immediately to apply the necessary authorization checks.

Proactive Monitoring: Monitor WordPress audit logs for suspicious account modifications, password reset requests, or unusual administrative activity initiated by standard customer accounts.

Compensating Controls: If an immediate update is not feasible, restrict access to the booking administrative interface or disable the plugin temporarily to prevent exploitation. Implement a Web Application Firewall (WAF) to detect and block unauthorized requests directed at the user update endpoints.

Public Exploit Available: Unknown.

This vulnerability represents a significant security risk for any organization utilizing the Amelia Booking plugin for appointment management. Administrators must prioritize the application of the vendor-provided patch to remediate the broken access control mechanism. Failure to update promptly leaves the entire WordPress installation vulnerable to full administrative takeover by any registered user.