Amelia < 2.4.6 – Provider+ Cross-Customer Appointment Data Disclosure via IDOR | CVE 2026-14213

Description

The plugin does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.

Proof of Concept

Prerequisites: Amelia (free or Pro) with at least two Employees, and an appointment booked for an employee other than the attacker.

1) As a logged-in WordPress user holding the Amelia Employee role, load the Amelia calendar admin page and read the wpAmeliaNonce value.

2) Read any appointment by id, including appointments assigned to other employees:
GET /wp-admin/admin-ajax.php?action=wpamelia_api&call=/appointments/1&wpAmeliaNonce=NONCE
-> "Successfully retrieved appointment" including the booked customer's name, email, phone and note, for an appointment the employee is not assigned to.

When the provider-write feature is enabled, the same role can also overwrite any appointment's internal note by supplying an arbitrary appointment id to the appointment-note update route.

Expected: an employee discloses other employees' appointments and the booked customers' personal data by enumerating sequential appointment ids; the list endpoint, by contrast, correctly limits the employee to their own appointments.