---
id: CVE-2026-107616
title: >-
  Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization
  to Unauthenticated Arbitrary Event Attendee Data Exposure via
  '/report/event/attendees' Endpoint
summary: >-
  The Amelia plugin for WordPress is vulnerable to unauthorized access of
  attendee data due to a missing authorization check on the
  GetEventAttendeesCommandHandler::handle() function in versions up to, and
  including, 9.9.1. The handler onl…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: melograno
product: Booking for Appointments and Events Calendar – Amelia
affected:
  - booking_for_appointments_and_events_calendar_amelia >= 9.0 <= 9.9.1
published: '2026-11-07'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T09:25:48.668Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107616'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/c0a43f7f-1314-4894-aaf1-b7ef0f3e6217?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Application/Commands/Report/GetEventAttendeesCommandHandler.php#L49
  - url: >-
      https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Application/Controller/Report/GetEventAttendeesController.php#L30
  - url: >-
      https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Infrastructure/Routes/Report/Report.php#L40
  - url: >-
      https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Infrastructure/WP/config/Roles.php#L125
  - url: 'https://wpamelia.com/documentation/changelog/'
tags:
  - cve.org
ingestedAt: '2026-11-07T10:14:53.602Z'
epss: 0.00502
epssPercentile: 0.43232
---

## Overview

The Amelia plugin for WordPress is vulnerable to unauthorized access of attendee data due to a missing authorization check on the GetEventAttendeesCommandHandler::handle() function in versions up to, and including, 9.9.1. The handler only enforces the broad `amelia_read_events` capability — which the plugin's own `wpamelia-customer` role possesses — and does not verify that the authenticated user is an organizer/provider of the event referenced by the client-supplied `id` query parameter. This makes it possible for authenticated attackers, with wpamelia-customer-level access and above, to export the full CSV of attendee personally identifiable information (first/last name, email, phone, date of birth, gender, private notes, payment amounts/methods, WooCommerce order IDs, custom-field values, and uploaded-file URLs) for any Amelia event on the site by directly invoking the `/report/event/attendees` endpoint with an arbitrary event ID.

## Affected

- `booking_for_appointments_and_events_calendar_amelia >= 9.0 <= 9.9.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.