CVE-2026-5465 Details
Description
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.3. This is due to the `UpdateProviderCommandHandler` failing to validate changes to the `externalId` field when a Provider (Employee) user updates their own profile. The `externalId` maps directly to a WordPress user ID and is passed to `wp_set_password()` and `wp_update_user()` without authorization checks. This makes it possible for authenticated attackers, with Provider-level (Employee) access and above, to take over any WordPress account — including Administrator — by injecting an arbitrary `externalId` value when updating their own provider profile.
A vulnerability exists in the Booking for Appointments and Events Calendar – Amelia plugin for WordPress, in all versions through 2.1.3. The issue is an Insecure Direct Object Reference (IDOR) that allows authenticated users with Provider-level (Employee) access to escalate privileges. The vulnerability arises because the 'UpdateProviderCommandHandler' does not properly validate the 'externalId' field when providers update their profiles. This 'externalId' directly corresponds to a WordPress user ID and is sent to 'wp_set_password()' and 'wp_update_user()' without any authorization checks. As a result, an authenticated attacker could inject an arbitrary 'externalId' value to take over any WordPress account, including those of administrators.
Users are advised to update the Amelia WordPress plugin to version 2.2 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 7, 2026CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Amelia | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 7, 2026 | New CVE Received | [email protected] |