CVE-2026-103915
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The Amelia (Booking for Appointments and Events Calendar) plugin for WordPress in versions up to and including 2.4.12 is vulnerable to Sensitive Information Exposure via the 'page' parameter. Unauthenticated attackers can extract staff personally identifiable information (full name, email address, phone number, gender, timezone) and administrator-authored internal notes for every published event, because the raw providers array is never stripped before output in the JSON response.
Risk Assessment
Leakage of staff PII and internal notes can breach privacy, create GDPR compliance risk, and facilitate social engineering attacks. The vulnerability is accessible without authentication.
Recommendation
Update the Amelia plugin to a version later than 2.4.12. Until updated, consider restricting access to booking features or disabling the plugin.
Other vulnerabilities in Amelia
See all- CVE-2026-112327Critical
The Amelia plugin for WordPress (versions up to 2.4.11) is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. This may allow manipulation of database queries.
- CVE-2026-57702Critical
The Amelia WordPress plugin contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This affects versions up to and including 2.4.2.
- CVE-2026-116396Medium
The Amelia WordPress plugin (through version 2.4.12) does not properly neutralize input during web page generation, enabling Stored Cross-site Scripting (XSS). A malicious script can be persistently stored and executed in a user's browser.
- CVE-2026-116388Medium
The Amelia WordPress plugin (through version 2.4.10) has missing authorization, allowing exploitation of incorrectly configured access control security levels. An attacker could perform operations they should not be permitted to.
- CVE-2026-109684Medium
Missing Authorization vulnerability in TMS Amelia ameliabooking allows exploiting incorrectly configured access control security levels. This issue affects Amelia from n/a through 2.4.10.
- CVE-2026-96461High
A Missing Authorization vulnerability in the Amelia plugin for WordPress, affecting versions up to 2.4.10, allows exploitation of incorrectly configured access control security levels.
- CVE-2026-62112High
The Amelia plugin in versions up to and including 2.4.9 contains an Editor SQL Injection vulnerability. This allows users with editor privileges to inject malicious SQL queries into the database.
- CVE-2026-6286High
The Amelia plugin for WordPress up to version 2.2 is vulnerable to Stored Cross-Site Scripting via customer name fields. An authentication bypass allows unauthenticated users to submit booking data, and in the admin calendar view, customer names are interpolated into JavaScript template literals and rendered via innerHTML without proper HTML entity encoding. An attacker can inject malicious scripts that execute when an administrator hovers over the appointment.
- CVE-2026-14782Medium
The Amelia plugin for WordPress is vulnerable to SQL Injection during customer import. This affects all versions up to and including 2.4.3 due to insufficient input escaping and lack of query preparation.
- CVE-2026-48889High
Amelia versions up to 2.3 contain a vulnerability that allows subscriber privilege escalation.
Original NVD description (English source)
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.12 via the 'page' parameter. This makes it possible for unauthenticated attackers to extract staff personally identifiable information — including full name, email address, phone number, gender, and timezone — as well as administrator-authored internal notes for every published event, all serialized into the JSON response because the raw providers array is never stripped before output.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS