CVE-2026-77705
Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover
CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.
| Vendor | unknown |
| Product | booking for appointments and events calendar |
| Published | Sep 12, 2026 |
| Last Updated | Sep 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown booking for appointments and events calendar
Be the first to know when new high vulnerabilities affecting unknown booking for appointments and events calendar are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Booking for Appointments and Events Calendar
0 < 2.4.10
References
Credits
Karthik Ramakrishnan WPScan