WordPress Plugin Vulnerabilities

Amelia < 2.4.7 - Unauthenticated Notification Queue Dispatch

Description

The plugin does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.

Proof of Concept

Affects Plugins

Plugin icon
ameliabooking
Fixed in 2.4.7

References

CVE
CVE-2026-14216

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Manuel Martínez Casasola
Submitter
Manuel Martínez Casasola
Submitter website
https://curiosidadesdehackers.com/
Submitter twitter
HackersCuriosos
Verified
Yes
WPVDB ID
c38bf5b3-902c-4126-a9a3-42d9f2d359c3

Timeline

Publicly Published
2026-08-24 (about 3 days ago)
Added
2026-08-24 (about 2 days ago)
Last Updated
2026-08-24 (about 2 days ago)

Other

Published
Title
Published
2025-03-06
Title
WPCOM Member < 1.7.6 - Authentication Bypass via 'user_phone'
Published
2026-08-05
Title
Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address Header
Published
2026-06-10
Title
WebAuthn Provider for Two Factor < 2.5.6 - 2FA Bypass
Published
2025-03-13
Title
WP JobHunt <= 7.1 - Authentication Bypass to Candidate
Published
2020-07-14
Title
Email Verification for WooCommerce < 1.8.2 - Loose Comparison to Authentication Bypass