Overview

CVE-2026-9055 is an Improper Privilege Management vulnerability (CWE-269) in the Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress, affecting versions 8.0 through 9.6.2. The flaw stems from insufficient validation of the attacker-controlled type parameter on the customer-update endpoint, combined with unchecked handling of the externalId parameter.

Wordfence assigned the CVE and published it on September 2, 2026, with a reservation date of May 20, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical):

This reflects a network-exploitable, low-complexity flaw requiring no privileges and no user interaction.

Affected Versions

• Amelia (Premium) 8.0 – 9.6.2

Verify against the vendor's official changelog for the fixed release rather than relying on version numbers alone.

Technical Breakdown (Root Cause)

The vulnerability lives in the customer-update REST endpoint's handling of role assignment. At a high level (no exploitation steps included):

1. The endpoint trusts an attacker-supplied type value when deciding what role to assign a customer record, rather than deriving the role from server-side authorization state.
2. When the externalId parameter is set to 0, the handler triggers creation of a WordPress user carrying the wpamelia-manager role — a privileged internal role used by the plugin.
3. Because the initial request requires no authentication, an anonymous visitor can obtain a manager-level account this way.
4. From the manager role, a similar insufficient-ownership validation reappears in the provider-entity update flow: a provider record can be linked to an arbitrary WordPress user ID, including an existing administrator's, and that user's credentials can subsequently be overwritten.
5. The end state is full administrator account takeover, achieved purely through chained logic flaws — no memory corruption, file upload, or code injection primitive required.

This mirrors a broader pattern seen across several WordPress plugin CVEs this cycle (e.g. CVE-2026-0844, CVE-2026-4021): privilege or role-defining parameters accepted from client input without re-validating against server-held authorization state.

Attack Chain (Generalized)

No macros, payload staging, or external C2 infrastructure is needed at this stage — this is a pure logic-flaw chain confined to the WordPress REST API surface.

Detection Guidance

See detection/detection-guidance.md for the full rule set. Summary:

• Monitor WordPress REST API access logs for unauthenticated requests to Amelia's customer-update and provider-update endpoints (/wp-json/amelia/v1/...).
• Alert on any request to these endpoints carrying an externalId=0 value paired with a type field, especially from sessions with no prior authentication.
• Audit wp_usermeta / wp_capabilities for unexpected assignment of the wpamelia-manager role or elevation to administrator outside known admin activity.
• Flag password-reset or password-overwrite events on administrator accounts that correlate with recent Amelia provider-entity changes.
• Review new administrator accounts for correlation with Amelia-plugin activity timestamps.

Indicators of Compromise

• Unexpected WordPress users with role wpamelia-manager that admins did not create.
• Provider entities in the Amelia plugin database linked to administrator user IDs that don't match legitimate staff-provider mappings.
• Administrator password changes with no corresponding password-reset request from the account owner.
• REST API log entries hitting Amelia endpoints from IPs with no prior legitimate session.

Mitigation

See detection/mitigation-checklist.md for the full checklist. Summary:

• Update Amelia (Premium) to the patched version as soon as the vendor releases one (check changelog past 9.6.2).
• If immediate patching isn't possible, restrict public access to the plugin's REST endpoints via a WAF rule blocking unauthenticated calls to the customer/provider update routes.
• Audit all existing wpamelia-manager and administrator accounts now — the CVE was reserved back in May 2026, so exploitation may predate public disclosure.
• Rotate credentials for all administrator accounts as a precaution on any site running an affected version.
• Consider virtual patching through a managed WordPress WAF while waiting for an official fix.

References

• references/sources.md — Wordfence advisory, OffSeq Threat Radar entry, and vendor changelog links.

Disclaimer

This repository is published for defensive and educational purposes only. It contains analysis, detection logic, and mitigation guidance derived from public vulnerability disclosures. No functional exploit code is provided. Use this information only on systems you are authorized to test and defend.

Maintained by Sentinel AI Defense · Findings shared responsibly under coordinated disclosure.