CVE-2026-14311

Executive Summary

CVE-2026-14311 is a critical broken access control vulnerability (CWE-862) affecting the Premium version of the Amelia WordPress plugin (versions up to and including 2.4.4). Due to a missing ownership verification on the /users/customers/<id> endpoint, an authenticated attacker with the wpamelia-provider role can view and modify arbitrary customer records, including initiating password resets. This flaw allows for the takeover of WordPress user accounts with roles up to Editor, provided the victim has previously made an Amelia booking. The CVSS v3.1 base score is 5.4 (Medium), reflecting a significant confidentiality and integrity impact within the plugin's scope.

Technical Analysis

The vulnerability resides in the Amelia WordPress plugin, specifically within the /users/customers/<id> REST API endpoint or internal routing logic. The CWE-862 (Missing Authorization) classification indicates a failure to perform a capability or ownership check before allowing an action on a specific resource.

In this scenario, the endpoint is designed to allow users with the wpamelia-provider role (typically employees or service providers using the Premium Employee Panel) to manage customer data. However, the application fails to verify that the provider requesting the data actually owns or has administrative rights over the customer identified by the <id> parameter.

Because the <id> parameter is user-controlled, an attacker can iterate through customer IDs (IDOR - Insecure Direct Object Reference). This allows them to bypass the intended access scope. While the CVSS vector (PR:L) indicates a low privilege requirement, the required wpamelia-provider role is a specific, authenticated WordPress role introduced by the plugin. The vulnerability affects only the Premium version of the plugin where the Employee Panel feature is enabled.

Exploitation Scenarios

Note: No public PoC or exploit code is available. The following attack chain is inferred strictly from the vulnerability class (CWE-862) and the NVD description.

1. Reconnaissance/Target Identification: An attacker identifies a WordPress site running the Premium version of the Amelia plugin (versions <= 2.4.4). This can be done by inspecting the page source for plugin-specific assets or using Shodan dorks targeting the plugin directory.
2. Initial Access (Prerequisite): The attacker obtains a low-privileged authenticated account with the wpamelia-provider role. This role is typically assigned to employees or service providers. This could be achieved through self-registration if enabled, social engineering, or compromising a provider account.
3. Triggering the Flaw: Once authenticated, the attacker sends HTTP requests to the vulnerable /users/customers/<id> endpoint. Instead of requesting their own customer ID, they manipulate the <id> parameter (e.g., /users/customers/1, /users/customers/2, etc.) to target other customers in the system.
4. Execution & Impact: Due to the missing ownership verification, the server responds with the requested customer data. The attacker can view Personally Identifiable Information (PII) and modify customer records. Crucially, the description notes that this allows for "password reset," enabling the attacker to trigger a password reset for the targeted customer. If the targeted customer is also a WordPress user with a role up to Editor, the attacker can take over that account by resetting the password or modifying the associated email address.

Impact Assessment

The CVSS v3.1 base score is 5.4, with Confidentiality (C:L) and Integrity (I:L) impacts rated as Low. Availability is not impacted. The scope is Unchanged (S:U), meaning the impact is confined to the vulnerable component and its data, although the account takeover of an Editor user could escalate privileges within the WordPress site.

Business impact includes unauthorized exposure of customer PII (names, emails, phone numbers, booking history) and the potential for data corruption. The ability to perform a password reset and takeover WordPress accounts (up to Editor) significantly elevates the risk. An Editor account can publish, modify, and delete posts, including those of other users, and manage categories, tags, and comments. In a multi-vendor or service-based business, the blast radius includes all customers whose IDs can be enumerated and all WordPress users (up to Editor) who have made an Amelia booking.

Detection Guidance

Sigma Rule

title: Amelia Plugin Missing Authorization on Customer Endpoint
id: 8f4b2c1a-9d3e-4a7b-8c2d-1e5f6a7b8c9d
status: experimental
description: Detects attempts to access or modify arbitrary customer IDs via the Amelia plugin /users/customers/<id> endpoint without ownership verification.
author: Valters IT Threat Intel
date: 2026-05-18
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection_endpoint:
        cs-uri-stem|contains: '/users/customers/'
    selection_method:
        cs-method: 
            - 'GET'
            - 'POST'
            - 'PUT'
            - 'PATCH'
    condition: selection_endpoint and selection_method
fields:
    - c-ip
    - cs-username
    - cs-uri-stem
    - cs-method
falsepositives:
    - Legitimate provider accessing their own customer data.
    - Automated scanning or fuzzing of the API.
level: high

YARA Rule

rule CVE_2026_14311_Amelia_IDOR
{
    meta:
        description = "Detects exploitation attempts targeting CVE-2026-14311 in Amelia plugin"
        author = "Valters IT Threat Intel"
        date = "2026-05-18"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-14311"
        hash = "unknown"
    strings:
        $endpoint = "/users/customers/"
        $plugin_dir = "wp-content/plugins/ameliabooking"
    condition:
        $endpoint and $plugin_dir
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-14311 Amelia Plugin IDOR Attempt on Customer Endpoint"; flow:to_server,established; content:"/users/customers/"; http_uri; content:"wpamelia-provider"; http_cookie; classtype:attempted-user; sid:100014311; rev:1; metadata:created_at 2026_05_18, updated_at 2026_05_18, cve CVE_2026_14311;)

Elastic Detection

network where process.name == "httpd" and http.request.method in ("GET", "POST", "PUT", "PATCH") and http.request.uri : "/users/customers/*" and http.request.headers : "*wpamelia-provider*"

Splunk SPL Query

index=web sourcetype=access_combined 
| search uri_path="/users/customers/*" method IN ("GET", "POST", "PUT", "PATCH") 
| stats count by src_ip, uri_path, method, status 
| where count > 5

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100143" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>/users/customers/</url>
    <description>CVE-2026-14311: Amelia plugin unauthorized access to customer endpoint.</description>
    <mitre>
      <id>T1190</id>
      <id>T1078</id>
    </mitre>
    <group>cve_2026_14311,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch; not independently confirmed).

1. Immediate Mitigations:

   • Disable the Employee Panel feature if not strictly required for business operations.
   • Audit all user accounts with the wpamelia-provider role. Remove the role from any accounts that do not absolutely require it.
   • Implement a Web Application Firewall (WAF) rule to block requests to /users/customers/ where the ID parameter does not match the authenticated provider's scope.
   • Force a password reset for all WordPress users with roles up to Editor who have made an Amelia booking, as a precaution against compromised password reset flows.

2. Patch/Upgrade Steps:

   • The NVD description implies a fix is available in versions greater than 2.4.4. Administrators should update the Amelia Premium plugin to the latest available version immediately.
   • Verify the integrity of the plugin files post-upgrade to ensure no backdoors were left by a previous compromise.
   • Review access logs for any suspicious access to the /users/customers/ endpoint prior to the patch.

3. Long-Term Hardening:

   • Implement a robust access control framework that enforces ownership checks at the API level, rather than relying on client-side restrictions or role-based checks alone.
   • Conduct regular security audits and code reviews focusing on IDOR and Broken Access Control vulnerabilities.
   • Utilize a bug bounty program or third-party security assessments for critical plugins.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-14311
• CWE-862: https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/
• MITRE ATT&CK T1078: https://attack.mitre.org/techniques/T1078/
• CISA KEV Catalog: Not applicable (CVE is not listed). Note: No threat actor campaigns or exploit-in-the-wild evidence is currently available in the provided intelligence data.