CVEvulnerability
CVE-2022-0825
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-04-04
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 5.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:N
- Weaknesses
- CWE-863
Description
The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other's booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.
Affected configurations
• tms-outsource amelia (< 1.0.49)
Related
Weakness · CWE (1)
- CWE-863 Incorrect Authorization weakness
References
- https://plugins.trac.wordpress.org/changeset/2693545 Patch, Third Party Advisory
- https://wpscan.com/vulnerability/1a92a65f-e9df-41b5-9a1c-8e24ee9bf50e Exploit, Third Party Advisory
- https://plugins.trac.wordpress.org/changeset/2693545 Patch, Third Party Advisory
- https://wpscan.com/vulnerability/1a92a65f-e9df-41b5-9a1c-8e24ee9bf50e Exploit, Third Party Advisory