CVE-2026-107616

The Amelia plugin for WordPress (versions up to and including 9.9.1 ) is vulnerable to unauthorized data exposure due to a missing authorization check in the GetEventAttendeesCommandHandler::handle() function. The handler only verifies the broad amelia_read_events capability, which is held by the...

EUVD-2026-119040

The Amelia plugin for WordPress is vulnerable to unauthorized access of attendee data due to a missing authorization check on the GetEventAttendeesCommandHandler::handle function in versions up to, and including, 9.9.1. The handler only enforces the broad ameliareadevents capability — which the...