CVE-2026-16582

Executive Summary

CVE-2026-16582 is a missing-authorization vulnerability (CWE-862) in the WordPress plugin "Booking for Appointments and Events Calendar – Amelia," affecting all versions up to and including 2.4.5. Because the plugin accepts a client-supplied package-redemption identifier as proof of payment without validating it, an unauthenticated attacker can create approved appointment bookings without completing payment. The impact is integrity-only and localized (CVSS 5.3, I:L), meaning attackers can fabricate paid booking records without reading or destroying data, but cannot escalate to data confidentiality loss or full system compromise on their own.

Technical Analysis

The core weakness is a violation of the authorization/trust boundary between client and server. Per the NVD description, the plugin "accept[s] a client-supplied package-redemption identifier as proof of payment without validating it." In other words, the server treats a value that originates from the client as authoritative evidence that a payment (or a redeemable package credit) has been completed, rather than verifying that assertion against a trusted backend record before acting on it.

This is a class of vulnerability known as a broken authorization / insecure trust of client-controlled state (CWE-862, Missing Authorization). The relevant attack surface is the plugin's booking/redemption flow that is reachable by unauthenticated users — the same flow a legitimate visitor would use to redeem a pre-purchased package when booking an appointment. Because the payment-proof check is absent or non-authoritative, the normal precondition (a valid, paid, unredeemed package) can be bypassed.

Key technical facts that are supported by the supplied data:

• The flaw is authorization-related, not injection-related. No SQL, command, or template injection is described.
• The bypass is reachable without authentication (CVSS PR:N, UI:N), meaning no account, session, or victim interaction is required.
• The manipulated object is a "package-redemption identifier" supplied by the client. The description does not name the exact HTTP parameter, function, class, or endpoint — those are not disclosed and must not be assumed.
• The resulting state change is the creation of "approved appointment bookings" — i.e., a booking record advanced to an approved/confirmed status despite no valid payment.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) tells us the vulnerable component is network-reachable, requires no privileges or user interaction, and that impact is confined to a low-integrity modification within the plugin's own security scope. There is no described confidentiality impact (C:N) and no availability impact (A:N). The low integrity rating aligns with the fact that only booking/redemption state — not the underlying platform — can be forged.

Because the NVD description is relatively sparse, the exact request shape, identifier format, and validation logic are not documented here. What can be stated with confidence is the vulnerability class (missing authorization on a client-trusted payment proof) and the observable effect (creation of approved, unpaid bookings).

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code was available at the time of writing. The following chain is inferred strictly from the vulnerability class and the NVD description; specific parameter names and endpoints are not disclosed and are therefore not invented here.

1. Reconnaissance / target identification. An attacker identifies internet-facing WordPress sites running the Amelia booking plugin at a version ≤ 2.4.5. This is typically done by fingerprinting plugin assets under the WordPress plugins directory (e.g., requests to Amelia's public booking/redemption pages/assets) or via search engines and Shodan using plugin-related HTML markers.

2. Triggering the flaw. The attacker locates the public booking flow that supports redeeming a purchased package. Because the server uses a client-supplied package-redemption identifier as the proof of payment, the attacker supplies or manipulates that identifier in the request instead of providing genuine payment confirmation. No authentication or victim interaction is required (PR:N, UI:N).

3. Execution method (class level). This is an application-logic/authorization bypass, not memory corruption or code injection. The attacker submits a crafted booking request in which the redemption identifier is attacker-controlled and unvalidated, causing the server to accept it as evidence that payment was made/credits were available. No malicious file, script payload, or shell is required.

4. Post-exploitation impact. Successful exploitation creates approved appointment bookings without payment. Depending on the site's configuration and follow-on workflows, this can consume staff time and calendar slots, degrade scheduling integrity, and create false records that may trigger downstream notifications or reporting. It does not, per the CVSS metrics, grant data read access or cause service unavailability.

Impact Assessment

• Primary impact: Unauthorized modification of data (integrity) within the booking plugin — creation of approved, unpaid bookings. CVSS integrity subscore: Low (I:L).
• Confidentiality / Availability: None described (C:N, A:N).
• Blast radius: Sites running Amelia ≤ 2.4.5 that expose the package-redemption booking flow to unauthenticated users. The vulnerability is scoped to the plugin (S:U), so it does not inherently compromise the broader WordPress installation.
• Business impact: Fraudulent or unsanctioned bookings can lead to lost revenue (services rendered without payment), schedule/resource exhaustion, and data-integrity issues in operator dashboards or connected calendars. Reputational or downstream operational harm depends on how bookings are consumed.
• Exploitability: Network-reachable, low complexity, no privileges, no user interaction — easy to attempt at scale against exposed instances, though the low integrity impact and lack of PoC temper urgency. EPSS has not been scored by FIRST.org; no EPSS value is asserted. CISA KEV: NO — no known in-the-wild exploitation documented in the supplied data.

Detection Guidance

Note: Because the exact request parameters and endpoints are not disclosed in the source data, the rules below target generic WordPress-plugin exploitation patterns, booking/redemption endpoint access, and anomalous unauthenticated booking creation. Analysts should tune field names to their environment.

Sigma Rule

title: Potential Amelia Booking Plugin Unauthorized Booking Creation (CVE-2026-16582)
id: 9f2c1a70-3b1e-4c8a-9d21-7a5e0f6b1c44
status: experimental
description: Detects unauthenticated access to Amelia booking/package-redemption endpoints suggesting attempted payment-bypass booking creation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-16582
author: Valters IT Threat Intel
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_plugin:
    cs-uri-stem|contains:
      - '/wp-content/plugins/ameliabooking/'
      - '/wp-admin/admin-ajax.php'
  selection_action:
    cs-uri-query|contains:
      - 'amelia'
      - 'booking'
      - 'package'
      - 'redeem'
  condition: selection_plugin and selection_action
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate unauthenticated bookings by genuine customers
level: low

YARA Rule

rule CVE_2026_16582_Amelia_Booking_Payment_Bypass
{
    meta:
        description = "Detects Amelia plugin versions potentially affected by CVE-2026-16582 payment-bypass booking flaw"
        author = "Valters IT Threat Intel"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-16582"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $plugin = "ameliabooking" ascii wide nocase
        $ver1 = "Version: 2.4.5" ascii
        $pkg  = "package" ascii wide nocase
        $redeem = "redeem" ascii wide nocase

    condition:
        $plugin and ($ver1 or ($pkg and $redeem))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-16582 Amelia Booking Plugin Unauthenticated Redemption Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/wp-content/plugins/ameliabooking/"; http.uri; content:"redeem"; nocase; http.uri; content:"package"; nocase; classtype:attempted-user; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-16582; sid:202616582; rev:1;)

Elastic Detection

network where
  network.transport == "tcp" and
  http.request.method == "POST" and
  (
    stringContains(http.request.uri, "ameliabooking") or
    stringContains(http.request.uri, "admin-ajax.php")
  ) and
  (
    stringContains(to_lower(http.request.body), "package") and
    stringContains(to_lower(http.request.body), "redeem")
  )

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=apache:access
| search uri_path="*ameliabooking*" OR uri_path="*admin-ajax.php*"
| search uri_query="*package*" OR uri_query="*redeem*" OR uri_query="*amelia*"
| stats count values(uri_path) AS paths values(uri_query) AS queries by clientip
| where count > 5

Wazuh OSSEC Rule

<group name="web,wordpress,ameliabooking,">
  <rule id="100165" level="6">
    <decoded_as>web-accesslog</decoded_as>
    <url>ameliabooking</url>
    <match>package|redeem</match>
    <description>CVE-2026-16582: Possible Amelia booking payment-bypass redemption attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — a single source lists a patch; not independently confirmed). No vendor fix version was provided in the source data.

1. Immediate mitigations

   • Restrict unauthenticated access to the package-redemption booking flow where operationally feasible (e.g., require login for package redemption, or gate the endpoint via your WAF/reverse proxy).
   • Deploy virtual patching / WAF rules to flag or block booking requests where redemption identifiers are submitted without an authenticated, paid session context.
   • Monitor booking logs for bursts of unauthenticated approved bookings and reconcile against payment records.
   • Consider temporarily disabling package-redemption functionality if you cannot otherwise enforce payment verification and fraudulent bookings create material operational risk.

2. Patch / upgrade steps

   • Because patch status is only CLAIMED, verify directly with the vendor (Amelia) for a fixed release and confirm the fixed version number before relying on it. Do not assume 2.4.5 is patched.
   • Update the plugin once a confirmed fix exists; test in a staging environment before production rollout, and re-validate the redemption flow.
   • If no fix is available, apply compensating controls (above) and treat all instances ≤ 2.4.5 as vulnerable.

3. Long-term hardening

   • Never treat client-supplied identifiers as authoritative proof of payment; validate redemption state server-side against trusted records.
   • Apply least-privilege and server-side authorization checks to all booking state transitions (e.g., moving a booking to "approved").
   • Keep WordPress and all plugins updated; subscribe to vendor and NVD advisories.
   • Add integrity/monitoring controls that alert on booking-state changes lacking an associated, verified payment event.

References

1. NVD — CVE-2026-16582: https://nvd.nist.gov/vuln/detail/CVE-2026-16582
2. CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
3. CVSS v3.1 Specification (scoring interpretation): https://www.first.org/cvss/v3.1/specification-document
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog (not listed as of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns / exploit-in-the-wild: No known campaigns or in-the-wild exploitation were documented in the supplied data (CISA KEV: NO; no public PoC, Nuclei template, or exploit code available).