CVE-2026-107616— Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure via '/report/event/attendees' Endpoint

Quick assessment

Affected

melograno Booking for Appointments and Events Calendar – Amelia

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Amelia 插件存在未经授权的参会者数据访问漏洞，原因是函数在 9.9.1 及更早版本中缺少授权检查。该处理程序仅执行了宽泛的能力检查（该插件自带的角色即拥有此能力），而未验证已认证用户是否为客户端通过查询参数指定的活动组织者或服务提供方。因此，拥有级别或更高权限的已认证攻击者，可以通过直接调用端点并传入任意活动 ID，导出网站上任何 Amelia 活动的完整参会者个人可识别信息（PII）CSV 文件。这些信息包括：姓名（姓/名）、电子邮件、电话号码、出生日期、性别、私人备注、

CVSS 7.5 · High Updated Nov 07, 2026

Possible ATT&CK Techniques 2 AI

T1038 T1203 · Exploitation for Client Execution

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure via '/report/event/attendees' Endpoint

Source: CVE Program / CVE List V5

Vulnerability Description

The Amelia plugin for WordPress is vulnerable to unauthorized access of attendee data due to a missing authorization check on the GetEventAttendeesCommandHandler::handle() function in versions up to, and including, 9.9.1. The handler only enforces the broad `amelia_read_events` capability — which the plugin's own `wpamelia-customer` role possesses — and does not verify that the authenticated user is an organizer/provider of the event referenced by the client-supplied `id` query parameter. This makes it possible for authenticated attackers, with wpamelia-customer-level access and above, to export the full CSV of attendee personally identifiable information (first/last name, email, phone, date of birth, gender, private notes, payment amounts/methods, WooCommerce order IDs, custom-field values, and uploaded-file URLs) for any Amelia event on the site by directly invoking the `/report/event/attendees` endpoint with an arbitrary event ID.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
melograno	Booking for Appointments and Events Calendar – Amelia	9.0 ~ 9.9.1	-

II. Public POCs for CVE-2026-107616

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-107616

请登录查看更多情报信息。

Vendor Pages for CVE-2026-107616 (1)

🔗 Changelog - Amelia WordPress Booking Plugin

Other References for CVE-2026-107616 (5)

https://www.cve.org/CVERecord?id=CVE-2026-107616

IV. Related Vulnerabilities

Same product: Booking for Appointments and Events Calendar – Amelia

Same vendor: melograno

Same weakness: CWE-862