---
id: "CVE-2026-103915"
kind: "vulnerability"
aliases: ["CVE-2026-103915"]
title: "Amelia WordPress booking plugin leaks staff personal data and internal notes"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["amelia", "booking-plugin", "package", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-31T09:16:32+00:00"
first_seen_at: "2026-10-31T09:34:41+00:00"
updated_at: "2026-10-31T09:35:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103915", "first_seen_at": "2026-10-31T09:34:41+00:00"}]
---

# Amelia WordPress booking plugin leaks staff personal data and internal notes

The Amelia booking plugin for WordPress, up to and including version 2.4.12, returns staff details in its JSON responses through the 'page' parameter. An unauthenticated visitor can read staff names, emails, phone numbers, genders, timezones and administrator notes for every published event.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Amelia plugin version in the WordPress admin plugin list or in the plugin's main file header.
- Treat any installed version up to and including `2.4.12` as affected.

## Fix

- Amelia plugin: unknown; the sources do not state a fixed version.

## Timeline

- 2026-10-31T09:34:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103915

## From the sources

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.12 via the 'page' parameter. This makes it possible for unauthenticated attackers to extract staff personally identifiable information — including full name, email address, phone number, gender, and timezone — as well as administrator-authored internal notes for every published event, all serialized into the JSON response because the raw providers array is never stripped before output.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_