AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2026-2931

HIGH · CVSS 8.8 EPSS 0.38%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2026-03-26 · Last synced 2026-08-04

CyberRota Analysis

This is a high severity vulnerability with a CVSS score of 8.8. It affects WordPress. Exploitation may require the attacker to be authenticated.

CVE
CVE-2026-2931
Severity
HIGH
CVSS
8.8
EPSS
0.38%
WordPress

Original NVD Description

The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 9.1.2. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated attackers with customer-level permissions or above to change user passwords and potentially take over administrator accounts. The vulnerability is in the pro plugin, which has the same slug.