{"id":"CVE-2026-116388","kind":"vulnerability","aliases":["CVE-2026-116388"],"related":[],"title":"TMS Amelia booking plugin: missing authorization check through version 2.4.10","description":"Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.","summary":"The TMS Amelia WordPress booking plugin (ameliabooking) has a missing authorization check in versions through 2.4.10, so access control is not enforced on some actions. The sources do not state exactly which data or actions an attacker can reach.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amelia-booking","ameliabooking","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Amelia plugin version in the WordPress admin plugins list, or with `wp plugin get ameliabooking --field=version`\n- Unknown whether other checks apply; the sources do not say which endpoints are affected","fix":"- Update the Amelia plugin to a version later than `2.4.10`\n- Unknown whether a specific fixed version is listed in the sources","status":"open","published_at":"2026-10-26T17:17:26+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","triaged_at":"2026-10-26T17:33:29+00:00","updated_at":"2026-10-26T17:33:29+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-26T17:33:29Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Amelia plugin to a version later than `2.4.10`\n- Unknown whether a specific fixed version is listed in the sources","reach":"internet","title":"TMS Amelia booking plugin: missing authorization check through version 2.4.10","impact":"medium","summary":"The TMS Amelia WordPress booking plugin (ameliabooking) has a missing authorization check in versions through 2.4.10, so access control is not enforced on some actions. The sources do not state exactly which data or actions an attacker can reach.","category":"package","nicknames":[],"who_cares":["wordpress","amelia-booking","ameliabooking"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown: unauthorized actions on the booking plugin, scope not stated","analyst_note":"Find the NVD or vendor advisory for CVE-2026-116388 to confirm which endpoints lack the authorization check and the fixed version.","how_to_check":"- Check the installed Amelia plugin version in the WordPress admin plugins list, or with `wp plugin get ameliabooking --field=version`\n- Unknown whether other checks apply; the sources do not say which endpoints are affected","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Amelia booking plugin (ameliabooking) at version 2.4.10 or earlier are in scope. The sources do not say which configurations expose the flaw, so the exposure of sites with other settings is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000612,"input_tokens":3299,"output_tokens":564,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116388':13A,16A '-2026':12A,15A '2.4.10':10A,38B,83C 'access':40B,73C 'action':47B,57B 'affect':78C 'allow':69C 'amelia':2A,18B,25B,67C,79C 'amelia-book':17B 'ameliabook':20B,29B,68C 'attack':59B 'author':6A,33B,63C 'book':3A,19B,27B 'check':7A,34B 'configur':72C 'control':41B,74C 'cve':11A,14A 'data':55B 'enforc':44B 'exact':53B 'exploit':70C 'incorrect':71C 'issu':77C 'levels.this':76C 'miss':5A,32B,62C 'n/a':81C 'packag':21B 'plugin':4A,28B 'reach':61B 'secur':75C 'sourc':49B 'state':52B 'tms':1A,24B,66C 'version':9A,36B 'vulner':64C 'wordpress':22B,26B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Amelia booking plugin (ameliabooking) at version 2.4.10 or earlier are in scope. The sources do not say which configurations expose the flaw, so the exposure of sites with other settings is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T17:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116388","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116388","severity":null,"published_at":"2026-10-26T17:17:26+00:00","modified_at":"2026-10-26T17:17:26+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","fetched_at":"2026-10-26T17:31:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}