Live › vulnerability › CVE-2026-116388
Go to dashboardThe TMS Amelia WordPress booking plugin (ameliabooking) has a missing authorization check in versions through 2.4.10, so access control is not enforced on some actions. The sources do not state exactly which data or actions an attacker can reach.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 17:31 UTC. All times on this page are UTC.
Sites running the Amelia booking plugin (ameliabooking) at version 2.4.10 or earlier are in scope. The sources do not say which configurations expose the flaw, so the exposure of sites with other settings is unknown.
No product ranges from the sources yet.
wp plugin get ameliabooking --field=version2.4.10Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.
This page as .md · .json · in your agent: get_signal("CVE-2026-116388")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.