The Amelia booking plugin for WordPress contains an authorization bypass vulnerability that allows authenticated attackers to perform unauthorized account takeovers, including administrative account compromise.

This vulnerability is an Insecure Direct Object Reference (CWE-639) occurring within the UpdateProviderCommandHandler. Authenticated attackers with Provider-level access can manipulate the externalId field to overwrite arbitrary user accounts, including those with administrative privileges, by bypassing necessary authorization checks.

Successful exploitation of this vulnerability results in full administrative control over the WordPress instance. This allows an attacker to exfiltrate sensitive data, modify core site configurations, or deploy malicious code across the environment. Given the high CVSS score of 8.8, this flaw represents a severe risk to organizational data integrity and system availability.

Immediate Action: Update the Amelia Booking plugin to version 2.1.4 or the latest available release to incorporate the necessary validation checks.

Proactive Monitoring: Review WordPress user account modification logs for suspicious activity, specifically monitoring for unauthorized changes to administrative account profiles.

Compensating Controls: Implement a Web Application Firewall (WAF) to monitor for malicious payloads targeting the UpdateProviderCommandHandler endpoint until the patch can be applied.

Public Exploit Available: No

This vulnerability presents a critical risk to WordPress environments using the Amelia plugin. Administrators should prioritize updating the plugin immediately to the latest version to prevent unauthorized account takeover and privilege escalation. Failure to patch leaves the application susceptible to complete compromise by any authenticated user with provider access.