CVE-2026-104992 · Package
NO FIX YET
The Amelia booking plugin for WordPress, in all versions up to and including 9.9.1, does not check whether a logged-in user may export booking records. An authenticated user with custom-level access or higher can download a CSV of attendee names, emails, phone numbers, payment details and coupon codes for any event on the site.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Amelia booking plugin for WordPress at version 9.9.1 or lower are exposed. The attacker must hold a logged-in account with custom-level access or above, so sites with only subscriber or customer accounts are less exposed. Sites that do not use Amelia can skip it.
Not affected if newer-version, no-custom-roles, plugin-not-installed
Who cares amelia, booking-plugin, wordpress
9.9.1 or lower.No fix yet, per the sources.
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.9.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to export a full CSV of booking records for any event on the site — including attendee names, email addresses, phone numbers, booking status, number of persons, price, payment status, payment amount, and coupon codes — regardless of whether they own or participate in those events.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.