CVE-2026-5465 PUBLISHED

Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter

Assigner: Wordfence
Reserved: 03.04.2026 Published: 07.04.2026 Updated: 07.04.2026

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.3. This is due to the UpdateProviderCommandHandler failing to validate changes to the externalId field when a Provider (Employee) user updates their own profile. The externalId maps directly to a WordPress user ID and is passed to wp_set_password() and wp_update_user() without authorization checks. This makes it possible for authenticated attackers, with Provider-level (Employee) access and above, to take over any WordPress account — including Administrator — by injecting an arbitrary externalId value when updating their own provider profile.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Product Status

Vendor ameliabooking
Product Booking for Appointments and Events Calendar – Amelia
Versions Default: unaffected
  • affected from 0 to 2.1.3 (incl.)

Credits

  • Osvaldo Noe Gonzalez Del Rio finder

References

Problem Types

  • CWE-639 Authorization Bypass Through User-Controlled Key CWE