WordPress Plugin Vulnerabilities

Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment

Description

The plugin does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.

Proof of Concept

Affects Plugins

Plugin icon
ameliabooking
Fixed in 2.4.4

References

CVE
CVE-2026-14214

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Manuel Martínez Casasola
Submitter
Manuel Martínez Casasola
Submitter website
https://curiosidadesdehackers.com/
Submitter twitter
HackersCuriosos
Verified
Yes
WPVDB ID
4dd7bb63-e058-49d8-96ba-1fe38985e78e

Timeline

Publicly Published
2026-07-20 (about 13 days ago)
Added
2026-07-20 (about 12 days ago)
Last Updated
2026-07-20 (about 12 days ago)

Other

Published
Title
Published
2023-08-08
Title
FULL - Customer < 2.3 - Subscriber+ Health Check Disclosure
Published
2020-04-08
Title
Klarna Checkout for WooCommerce < 2.0.10 - Authenticated Arbitrary Plugin Deactivation, Activation and Installation
Published
2019-08-12
Title
JVM WooCommerce Wishlist <= 1.2.6 - Insecure Direct Object Reference
Published
2022-10-31
Title
WP User Frontend < 3.5.29 - Obscure Registration as Admin
Published
2023-11-27
Title
Swift Performance Lite <= 2.3.6.14 - Unauthenticated Configuration Export