CVE-2026-103915 in Booking for Appointments and Events Calendar – Amelia Plugin
Summary
by MITRE • 10/31/2026
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.12 via the 'page' parameter. This makes it possible for unauthenticated attackers to extract staff personally identifiable information — including full name, email address, phone number, gender, and timezone — as well as administrator-authored internal notes for every published event, all serialized into the JSON response because the raw providers array is never stripped before output.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The Booking for Appointments and Events Calendar plugin, commonly known as Amelia, represents a widely utilized solution within the WordPress ecosystem designed to facilitate appointment scheduling and event management. While these tools provide significant utility for businesses and service providers by streamlining client interactions, they also introduce potential attack surfaces if not properly secured against common web vulnerabilities. In versions up through 2.4.12 of this plugin, a critical flaw exists that allows unauthenticated actors to access sensitive data without any form of authentication or authorization checks. This vulnerability stems from how the application handles input parameters related to page rendering and data retrieval processes within its API endpoints.
The core technical issue lies in the handling of the 'page' parameter during specific AJAX requests initiated by the plugin's frontend components. When a user interacts with the calendar interface, the system generates JSON responses containing various pieces of information required for display purposes. However, due to insufficient sanitization and filtering logic, the raw provider data array is passed directly into the response payload without stripping out sensitive fields that should remain internal or restricted. This means that any piece of personal identifiable information associated with staff members—such as their full names, email addresses, phone numbers, gender details, and configured timezones—is inadvertently included in the publicly accessible JSON output. Furthermore, this exposure extends to administrative metadata, specifically including internal notes authored by administrators for each published event, which are also serialized into the response body despite having no business reason to be visible on the client side.
From a classification perspective, this vulnerability aligns with CWE-200: Information Exposure, where security-relevant information is disclosed without explicit authorization or intent. The lack of proper access control mechanisms allows unauthenticated users to exploit this flaw simply by crafting specific HTTP requests targeting the affected endpoint. This scenario also reflects aspects of ATT&CK technique T1530: Data from Cloud Storage Objects if one considers how data structures are exposed, but more accurately fits within general web application reconnaissance patterns where attackers gather intelligence about an organization's personnel and operational details to facilitate further attacks such as social engineering or targeted phishing campaigns.
The operational impact of this vulnerability is significant for organizations relying on Amelia for their booking processes. The exposure of staff contact information compromises employee privacy and potentially violates data protection regulations like GDPR if personal data is mishandled. Additionally, the leakage of internal administrative notes provides attackers with contextual insights into business operations, scheduling constraints, or specific client interactions that could be leveraged for sophisticated social engineering attacks against both employees and customers. The ease of exploitation means that automated scanners can rapidly identify vulnerable instances across large segments of the WordPress infrastructure, leading to widespread data breaches even in environments where other security measures are robustly implemented.
To mitigate this risk, immediate action is required by updating the Amelia plugin to a version later than 2.4.12, where developers have addressed these input validation and output encoding issues. Administrators should ensure that all plugins within their WordPress installations are kept up-to-date with the latest security patches released by vendors. In cases where an update cannot be applied immediately due to compatibility concerns or other constraints, implementing a Web Application Firewall (WAF) rule set can help block malicious requests targeting the specific endpoint associated with this vulnerability. Regular audits of plugin code and adherence to secure coding practices that emphasize strict input validation and minimal data exposure in API responses are essential for maintaining long-term security posture against similar information disclosure flaws.