CVE-2026-9055 in Booking for Appointments and Events Calendar Plugin
Summary
by MITRE • 09/02/2026
The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint, which allows customers to set their role to 'manager' and trigger creation of a WordPress user with the wpamelia-manager role when the 'externalId' parameter is set to 0. This makes it possible for unauthenticated attackers to escalate their privileges to administrator by first elevating to the manager role, then creating a provider entity linked to an administrator user ID and overwriting that administrator's password.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in Amelia Premium versions 8.0 through 9.6.2 represents a critical privilege escalation flaw rooted in insufficient input validation within the application’s customer update endpoint. This security defect allows unauthenticated attackers to manipulate internal role assignments by exploiting specific parameters passed during API interactions. The core technical issue lies in the handling of the 'type' parameter, which is not adequately sanitized or validated against expected values before being processed by the backend logic. When an attacker submits a request with the 'externalId' parameter set to 0 and manipulates the 'type' field, the application fails to verify whether this action aligns with standard user permissions. Consequently, the system erroneously interprets this input as a valid instruction to elevate the requesting account’s status, triggering the creation of a WordPress user entity assigned the wpamelia-manager role. This initial step effectively grants the attacker elevated privileges within the Amelia plugin ecosystem, bypassing authentication requirements entirely due to the nature of the endpoint and the lack of proper access control checks at this stage.
Once the attacker has successfully escalated their status to that of a manager through the aforementioned mechanism, they gain access to additional administrative functions within the application interface that are typically restricted to higher-level users. The second phase of the attack vector involves leveraging these newly acquired privileges to create a provider entity. By linking this new provider entry to an existing administrator user ID, the attacker establishes a connection between their controlled account and a high-privilege system account. This linkage is critical because it allows the attacker to interact with data associated with that specific administrator profile. The final stage of exploitation involves overwriting the password of the targeted administrator user. Since the application does not enforce strict separation of duties or validate ownership when performing such updates, the attacker can reset the credentials for any linked administrative account, thereby gaining full control over the WordPress installation and its underlying data.
The operational impact of this vulnerability is severe, as it enables a complete compromise of the targeted WordPress environment without requiring prior authentication. An unauthenticated remote attacker can systematically escalate privileges from zero access to full administrator rights by chaining these two distinct exploitation steps. This level of access allows for arbitrary code execution, database manipulation, defacement, and the installation of persistent backdoors or malware. The ability to overwrite existing administrative passwords means that even if initial defenses are in place, an attacker who exploits this flaw can maintain long-term unauthorized access by assuming the identity of legitimate site administrators. This compromises not only the integrity of the website but also potentially exposes sensitive customer data stored within the appointment and event management system, leading to significant reputational damage and potential regulatory penalties under standards such as GDPR or CCPA depending on the jurisdiction and nature of the data involved.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management, specifically regarding the failure to enforce appropriate access controls for administrative functions. The exploitation technique mirrors patterns found in MITRE ATT&CK framework under T1078 Valid Accounts, as it involves obtaining legitimate credentials through privilege escalation rather than brute force or credential theft alone. Furthermore, the initial step of manipulating input parameters without validation relates closely to CWE-20 Improper Input Validation and CWE-639 Authorization Bypass Through User-Controlled Key. These classifications highlight the fundamental design flaws that allow an external actor to manipulate internal state variables and bypass intended security boundaries.
To mitigate this risk, immediate action is required by updating the Amelia Premium plugin to a version later than 9.6.2 where these validation checks have been reinforced. Administrators should ensure that all plugins are kept up-to-date with the latest security patches released by vendors. In environments where updates cannot be applied immediately due to compatibility concerns, implementing Web Application Firewall rules can help detect and block requests containing suspicious parameter combinations indicative of this exploitation attempt. Additionally, enforcing strict input validation on server-side endpoints for role assignment operations is essential to prevent similar vulnerabilities in other applications. Regular security audits focusing on authorization logic and privilege escalation paths should be conducted to identify and remediate analogous weaknesses before they can be exploited by malicious actors seeking unauthorized access to critical systems.