CVE-2026-104992 Details

A vulnerability exists in the Booking for Appointments and Events Calendar - Amelia plugin for WordPress, in all versions up to and including 9.9.1. The issue stems from the plugin's failure to properly verify user authorization, allowing authenticated attackers with custom-level access and above to bypass authorization. Exploitation of this vulnerability enables the unauthorized export of a comprehensive CSV file containing booking records for any event on the site. The exported data includes sensitive information such as attendee names, email addresses, phone numbers, booking status, number of persons, price, payment status, payment amount, and coupon codes, regardless of the attacker's involvement in the events.

Users are advised to update the Booking for Appointments and Events Calendar - Amelia plugin to version 9.9.2 or a newer patched version.