{"id":"CVE-2026-103915","kind":"vulnerability","aliases":["CVE-2026-103915"],"related":[],"title":"Amelia WordPress booking plugin leaks staff personal data and internal notes","description":"The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.12 via the 'page' parameter. This makes it possible for unauthenticated attackers to extract staff personally identifiable information — including full name, email address, phone number, gender, and timezone — as well as administrator-authored internal notes for every published event, all serialized into the JSON response because the raw providers array is never stripped before output.","summary":"The Amelia booking plugin for WordPress, up to and including version 2.4.12, returns staff details in its JSON responses through the 'page' parameter. An unauthenticated visitor can read staff names, emails, phone numbers, genders, timezones and administrator notes for every published event.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amelia","booking-plugin","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Amelia plugin version in the WordPress admin plugin list or in the plugin's main file header.\n- Treat any installed version up to and including `2.4.12` as affected.","fix":"- Amelia plugin: unknown; the sources do not state a fixed version.","status":"open","published_at":"2026-10-31T09:16:32+00:00","first_seen_at":"2026-10-31T09:34:41+00:00","triaged_at":"2026-10-31T09:35:47+00:00","updated_at":"2026-10-31T09:35:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T09:35:47Z","model":"claude-haiku-5-5","output":{"fix":"- Amelia plugin: unknown; the sources do not state a fixed version.","reach":"internet","title":"Amelia WordPress booking plugin leaks staff personal data and internal notes","impact":"medium","summary":"The Amelia booking plugin for WordPress, up to and including version 2.4.12, returns staff details in its JSON responses through the 'page' parameter. An unauthenticated visitor can read staff names, emails, phone numbers, genders, timezones and administrator notes for every published event.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","amelia","booking-plugin"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated visitors read staff personal data and private event notes","analyst_note":"Confirm the first patched Amelia version and whether the 'page' parameter exposure is default-configured; NVD entry is the only source.","how_to_check":"- Check the installed Amelia plugin version in the WordPress admin plugin list or in the plugin's main file header.\n- Treat any installed version up to and including `2.4.12` as affected.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Amelia booking plugin for WordPress at version 2.4.12 or earlier are exposed, and the flaw is reachable without logging in. Sites without Amelia installed are not affected. The sources do not say whether non-default settings change exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.0007,"input_tokens":4195,"output_tokens":561,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-103915':14A,17A '-2026':13A,16A '2.4.12':35B,90C 'address':112C 'administr':60B,122C 'administrator-author':121C 'amelia':1A,18B,25B,73C 'appoint':69C 'array':140C 'attack':101C 'author':123C 'book':3A,20B,26B,67C 'booking-plugin':19B 'calendar':72C 'cve':12A,15A 'data':8A 'detail':38B 'email':54B,111C 'event':65B,71C,129C 'everi':63B,127C 'exposur':82C 'extract':103C 'full':109C 'gender':57B,115C 'identifi':106C 'includ':33B,89C,108C 'inform':81C,107C 'intern':10A,124C 'json':41B,134C 'leak':5A 'make':96C 'name':53B,110C 'never':142C 'note':11A,61B,125C 'number':56B,114C 'output':145C 'packag':22B 'page':45B,93C 'paramet':46B,94C 'person':7A,105C 'phone':55B,113C 'plugin':4A,21B,27B,74C 'possibl':98C 'provid':139C 'publish':64B,128C 'raw':138C 'read':51B 'respons':42B,135C 'return':36B 'sensit':80C 'serial':131C 'staff':6A,37B,52B,104C 'strip':143C 'timezon':58B,117C 'unauthent':48B,100C 'version':34B,85C 'via':91C 'visitor':49B 'vulner':78C 'well':119C 'wordpress':2A,23B,29B,76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Amelia booking plugin for WordPress at version 2.4.12 or earlier are exposed, and the flaw is reachable without logging in. Sites without Amelia installed are not affected. The sources do not say whether non-default settings change exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T09:16:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103915","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103915","severity":null,"published_at":"2026-10-31T09:16:32+00:00","modified_at":"2026-10-31T09:16:32+00:00","first_seen_at":"2026-10-31T09:34:41+00:00","fetched_at":"2026-10-31T09:34:41+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}