CVE-2022-0720

CVE-2022-0720 affects the WordPress Amelia plugin prior to 1.0.47. The described vulnerability is improper authorization when managing appointments, allowing any customer to update someone else’s booking and to retrieve sensitive information (full name and phone number). The issue is supported by...

Amelia < 1.0.49 - Customer+ Arbitrary Appointments Status Update

The plugin does not have proper authorisation when managing appointments, allowing any customer to update other's booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it. PoC 1. Make a booking to become...