WordPress Plugin Vulnerabilities

Amelia < 2.4 - Subscriber+ Privilege Escalation

Description

The plugin is vulnerable to Privilege Escalation. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.

Affects Plugins

Plugin icon
ameliabooking
Fixed in 2.4

References

CVE
CVE-2026-48889
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/94e17808-9eb7-4a4d-8287-30d571df0f77

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
8.8 (high)

Miscellaneous

Original Researcher
dodoh4t
Verified
Yes
WPVDB ID
0df3b2df-4e71-4f9d-9620-38bb82bb68fd

Timeline

Publicly Published
2026-06-02 (about 2 months ago)
Added
2026-06-11 (about 2 months ago)
Last Updated
2026-08-21 (about 2 days ago)

Other

Published
Title
Published
2025-07-08
Title
WooCommerce Registration Fields Plugin - Custom Signup Fields <= 3.2.3 - Authenticated (Subscriber+) Privilege Escalation
Published
2026-07-22
Title
WP BASE Booking of Appointments, Services and Events < 6.3.2 - Subscriber+ Privilege Escalation
Published
2026-01-22
Title
Institutions Directory <= 1.3.4 - Subscriber+ Privilege Escalation
Published
2025-01-03
Title
WPGuppy < 1.1.1 - Subscriber+ Privilege Escalation
Published
2025-08-21
Title
Miraculous Core < 2.0.8 - Unauthenticated Privilege Escalation