CVE-2026-107616 Details
Description
The Amelia plugin for WordPress is vulnerable to unauthorized access of attendee data due to a missing authorization check on the GetEventAttendeesCommandHandler::handle() function in versions up to, and including, 9.9.1. The handler only enforces the broad `amelia_read_events` capability — which the plugin's own `wpamelia-customer` role possesses — and does not verify that the authenticated user is an organizer/provider of the event referenced by the client-supplied `id` query parameter. This makes it possible for authenticated attackers, with wpamelia-customer-level access and above, to export the full CSV of attendee personally identifiable information (first/last name, email, phone, date of birth, gender, private notes, payment amounts/methods, WooCommerce order IDs, custom-field values, and uploaded-file URLs) for any Amelia event on the site by directly invoking the `/report/event/attendees` endpoint with an arbitrary event ID.
A vulnerability in the Amelia WordPress plugin, affecting versions up to and including 9.9.1, allows unauthorized access to event attendee data. This issue arises from a missing authorization check in the GetEventAttendeesCommandHandler::handle() function. The handler only requires the broad amelia_read_events capability, which is granted to the wpamelia-customer role, without verifying if the user is an organizer or provider of the event specified by the id query parameter. As a result, authenticated attackers with wpamelia-customer-level access or higher can export a CSV file containing personally identifiable information of attendees, such as names, email addresses, phone numbers, dates of birth, genders, private notes, payment details, WooCommerce order IDs, custom field values, and uploaded file URLs, for any Amelia event on the site by using the /report/event/attendees endpoint with an arbitrary event ID.
Users are advised to update the Amelia WordPress plugin to version 9.9.2 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 7, 2026CISA-ADP
Assessed Nov 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Amelia | >= 9.0, <= 9.9.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 8, 2026 | CVE Modified | CISA-ADP |
| Nov 7, 2026 | New CVE Received | [email protected] |