Booking for Appointments and Events Calendar – Amelia Premium <= 7.7 and Lite < 1.2.5 - Missing Authorization to Sensitive Information Exposure

Description

The plugins are vulnerable to unauthorized access of data due to a missing capability check on the 'ameliaButtonCommand' function. This makes it possible for unauthenticated attackers to access employee calendar details, including Google Calendar OAuth tokens in the premium version.