WordPress Plugin Vulnerabilities

Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR

Description

The plugin does not verify that an authenticated employee (provider) is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any customer by enumerating sequential identifiers.

Proof of Concept

Affects Plugins

Plugin icon
ameliabooking
Fixed in 9.7

References

CVE
CVE-2026-14211

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
3.8 (low)

Miscellaneous

Original Researcher
Mustafa Ahmed
Submitter
Mustafa Ahmed
Submitter website
https://fortressmssp.com
Verified
Yes
WPVDB ID
511d2d53-34c5-4457-bc25-6f9105b57825

Timeline

Publicly Published
2026-08-07 (about 3 days ago)
Added
2026-08-07 (about 2 days ago)
Last Updated
2026-08-07 (about 2 days ago)

Other

Published
Title
Published
2026-07-30
Title
Fluent Forms < 6.2.9 - Unauthenticated Payment Receipt Disclosure via IDOR
Published
2024-06-06
Title
Tutor LMS – eLearning and online course solution < 2.7.2 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion
Published
2026-06-29
Title
ProfileGrid < 5.9.9.6 - Unauthenticated Privilege Escalation via Email Overwrite
Published
2026-07-07
Title
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration < 4.3.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription Overwrite
Published
2025-02-03
Title
Medical Addon for Elementor < 1.6.3 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode