{"id":"CVE-2026-107616","kind":"vulnerability","aliases":["CVE-2026-107616"],"related":[],"title":"Amelia WordPress plugin: customers can export any event's attendee data","description":"The Amelia plugin for WordPress is vulnerable to unauthorized access of attendee data due to a missing authorization check on the GetEventAttendeesCommandHandler::handle() function in versions up to, and including, 9.9.1. The handler only enforces the broad `amelia_read_events` capability — which the plugin's own `wpamelia-customer` role possesses — and does not verify that the authenticated user is an organizer/provider of the event referenced by the client-supplied `id` query parameter. This makes it possible for authenticated attackers, with wpamelia-customer-level access and above, to export the full CSV of attendee personally identifiable information (first/last name, email, phone, date of birth, gender, private notes, payment amounts/methods, WooCommerce order IDs, custom-field values, and uploaded-file URLs) for any Amelia event on the site by directly invoking the `/report/event/attendees` endpoint with an arbitrary event ID.","summary":"The Amelia booking plugin for WordPress up to and including 9.9.1 lets any logged-in customer request a CSV of attendee personal data for any event by changing the event ID. The exported data includes names, emails, phone numbers, dates of birth, private notes, payment details and uploaded-file URLs.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amelia","package","self-hosted","wordpress"],"not_affected_if":["no-customer-accounts","plugin-updated"],"how_to_check":"- Check the installed Amelia plugin version in the WordPress admin plugin list, or in the `Version` header of `wp-content/plugins/ameliabooking/ameliabooking.php`\n- Check whether customer accounts can register or log in on the site, since the `wpamelia-customer` role is what gives access","fix":"- Amelia plugin: move to a version later than `9.9.1`; the sources do not name the fixed version","status":"open","published_at":"2026-11-07T10:17:06+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","triaged_at":"2026-11-07T10:48:25+00:00","updated_at":"2026-11-07T10:48:25+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T10:48:25Z","model":"claude-haiku-5-5","output":{"fix":"- Amelia plugin: move to a version later than `9.9.1`; the sources do not name the fixed version","reach":"internet","title":"Amelia WordPress plugin: customers can export any event's attendee data","impact":"medium","summary":"The Amelia booking plugin for WordPress up to and including 9.9.1 lets any logged-in customer request a CSV of attendee personal data for any event by changing the event ID. The exported data includes names, emails, phone numbers, dates of birth, private notes, payment details and uploaded-file URLs.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","amelia","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attendee personal data and payment details for any event exported","analyst_note":"Confirm the fixed Amelia version from the vendor changelog or WordPress plugin page; the NVD entry gives only the affected range.","how_to_check":"- Check the installed Amelia plugin version in the WordPress admin plugin list, or in the `Version` header of `wp-content/plugins/ameliabooking/ameliabooking.php`\n- Check whether customer accounts can register or log in on the site, since the `wpamelia-customer` role is what gives access","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-updated","no-customer-accounts"],"who_is_affected":"Sites running the Amelia plugin at version 9.9.1 or earlier where anyone with a logged-in customer account (the wpamelia-customer role) can reach the report endpoint. Sites that do not allow customer registration or logins, or that run a newer plugin version, are not exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000757,"input_tokens":4440,"output_tokens":625,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107616':14A,17A '-2026':13A,16A '/report/event/attendees':210C '9.9.1':34B,106C 'access':85C,162C 'amelia':1A,18B,25B,77C,113C,201C 'amounts/methods':186C 'arbitrari':214C 'attack':156C 'attende':10A,45B,87C,171C 'authent':133C,155C 'author':93C 'birth':66B,181C 'book':26B 'broad':112C 'capabl':116C 'chang':52B 'check':94C 'client':145C 'client-suppli':144C 'csv':43B,169C 'custom':4A,40B,124C,160C,191C 'custom-field':190C 'cve':12A,15A 'data':11A,47B,58B,88C 'date':64B,179C 'detail':70B 'direct':207C 'due':89C 'email':61B,177C 'endpoint':211C 'enforc':110C 'event':8A,50B,54B,115C,140C,202C,215C 'export':6A,57B,166C 'field':192C 'file':74B,197C 'first/last':175C 'full':168C 'function':99C 'gender':182C 'geteventattendeescommandhandl':97C 'handl':98C 'handler':108C 'host':22B 'id':55B,147C,189C,216C 'identifi':173C 'includ':33B,59B,105C 'inform':174C 'invok':208C 'let':35B 'level':161C 'log':38B 'logged-in':37B 'make':151C 'miss':92C 'name':60B,176C 'note':68B,184C 'number':63B 'order':188C 'organizer/provider':137C 'packag':19B 'paramet':149C 'payment':69B,185C 'person':46B,172C 'phone':62B,178C 'plugin':3A,27B,78C,119C 'possess':126C 'possibl':153C 'privat':67B,183C 'queri':148C 'read':114C 'referenc':141C 'request':41B 'role':125C 'self':21B 'self-host':20B 'site':205C 'suppli':146C 'unauthor':84C 'upload':73B,196C 'uploaded-fil':72B,195C 'url':75B,198C 'user':134C 'valu':193C 'verifi':130C 'version':101C 'vulner':82C 'woocommerc':187C 'wordpress':2A,23B,29B,80C 'wpamelia':123C,159C 'wpamelia-custom':122C 'wpamelia-customer-level':158C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Amelia plugin at version 9.9.1 or earlier where anyone with a logged-in customer account (the wpamelia-customer role) can reach the report endpoint. Sites that do not allow customer registration or logins, or that run a newer plugin version, are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["amelia","high","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-107616':14A,17A '-2026':13A,16A 'amelia':1A 'attende':10A 'custom':4A 'cve':12A,15A 'data':11A 'event':8A 'export':6A 'plugin':3A 'wordpress':2A","search_b":"'9.9.1':34B 'amelia':18B,25B 'attende':45B 'birth':66B 'book':26B 'chang':52B 'csv':43B 'custom':40B 'data':47B,58B 'date':64B 'detail':70B 'email':61B 'event':50B,54B 'export':57B 'file':74B 'host':22B 'id':55B 'includ':33B,59B 'let':35B 'log':38B 'logged-in':37B 'name':60B 'note':68B 'number':63B 'packag':19B 'payment':69B 'person':46B 'phone':62B 'plugin':27B 'privat':67B 'request':41B 'self':21B 'self-host':20B 'upload':73B 'uploaded-fil':72B 'url':75B 'wordpress':23B,29B","search_c":"'/report/event/attendees':210C '9.9.1':106C 'access':85C,162C 'amelia':77C,113C,201C 'amounts/methods':186C 'arbitrari':214C 'attack':156C 'attende':87C,171C 'authent':133C,155C 'author':93C 'birth':181C 'broad':112C 'capabl':116C 'check':94C 'client':145C 'client-suppli':144C 'csv':169C 'custom':124C,160C,191C 'custom-field':190C 'data':88C 'date':179C 'direct':207C 'due':89C 'email':177C 'endpoint':211C 'enforc':110C 'event':115C,140C,202C,215C 'export':166C 'field':192C 'file':197C 'first/last':175C 'full':168C 'function':99C 'gender':182C 'geteventattendeescommandhandl':97C 'handl':98C 'handler':108C 'id':147C,189C,216C 'identifi':173C 'includ':105C 'inform':174C 'invok':208C 'level':161C 'make':151C 'miss':92C 'name':176C 'note':184C 'order':188C 'organizer/provider':137C 'paramet':149C 'payment':185C 'person':172C 'phone':178C 'plugin':78C,119C 'possess':126C 'possibl':153C 'privat':183C 'queri':148C 'read':114C 'referenc':141C 'role':125C 'site':205C 'suppli':146C 'unauthor':84C 'upload':196C 'uploaded-fil':195C 'url':198C 'user':134C 'valu':193C 'verifi':130C 'version':101C 'vulner':82C 'woocommerc':187C 'wordpress':80C 'wpamelia':123C,159C 'wpamelia-custom':122C 'wpamelia-customer-level':158C","first_public_at":"2026-11-07T10:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107616","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107616","severity":null,"published_at":"2026-11-07T10:17:06+00:00","modified_at":"2026-11-07T10:17:06+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","fetched_at":"2026-11-07T10:46:40+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}