CVE-2026-96461

Executive Summary

CVE-2026-96461 is a Missing Authorization (CWE-862) vulnerability in the TMS Amelia ("ameliabooking") WordPress plugin, affecting versions up to and including 2.4.10. It allows an unauthenticated, remote attacker to exploit incorrectly configured access-control security levels, resulting in a high integrity impact as scored by CVSS 3.1 (7.5). No public exploit, Nuclei template, or vendor patch currently exists, and the vendor has published no advisory or fixed version.

Technical Analysis

The NVD description assigns this issue to CWE-862 (Missing Authorization), with the accompanying language that the plugin "allows Exploiting Incorrectly Configured Access Control Security Levels." Both formulations point to the same root cause class: one or more plugin-exposed operations do not perform an authorization check before executing privileged logic. In WordPress plugin terms, this typically means a request handler — whether reached through the REST API, admin-ajax.php, or a directly invoked PHP entry point — lacks a capability check, a nonce verification, or both, so that a caller who is not authenticated (PR:N) and who supplies no valid credentials can still drive a state-changing action.

The CVSS vector is unusually informative for a sparse description. AV:N with PR:N and UI:N means the vulnerable surface is reachable over the network without credentials and without tricking an operator into an action, which rules out any attack requiring an authenticated session or a victim click. AC:L means no special preconditions, race windows, or memory-layout grooming are needed — the vulnerable path is reachable by simple request construction once the endpoint is identified. The impact triad C:N/I:H/A:N is the decisive signal: there is no confidentiality loss and no availability loss, but integrity impact is High. This is the signature of an unauthenticated state-modification primitive — a booking, record, setting, or configuration value can be created, altered, or overwritten, but the attacker does not read protected data and does not crash or exhaust the service.

That combination places the vulnerability in the same family as unauthenticated WordPress plugin endpoints that manipulate booking, pricing, status, or scheduling state. Because the description does not name any function, class, route, parameter, or file path, the specific vulnerable handler cannot be identified from the available data. The mechanism is asserted at the vulnerability-class level only: an access-control decision that should gate the operation is either absent or incorrectly configured, and the operation proceeds for an unauthorized caller. The scope is Unchanged (S:U), so the flaw remains within the plugin's own security authority and does not grant control over other components by itself.

The affected range is stated as "from n/a through 2.4.10," meaning all releases at or below 2.4.10 are presumed vulnerable. No fixed version is documented, and the patch-confidence assessment (0/4) reflects the absence of any patch or upgrade reference across tracked sources. Version 2.4.10 should be treated as the current last-known-vulnerable baseline rather than as a remediated release.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for this CVE. The following chain is inferred strictly from the vulnerability class (CWE-862), the CVSS vector, and the plugin identity. It does not assert any specific function, route, or parameter name, because none are provided in the source data.

1. Reconnaissance and target identification. The attacker enumerates internet-facing WordPress installations and fingerprints the Amelia plugin via its publicly served asset paths and page markup. Because the plugin renders booking and scheduling interfaces on public pages, its presence is observable without authentication. The attacker's objective at this stage is to confirm that the plugin is present and that the reported version is at or below 2.4.10.

2. Triggering the flaw class. Having identified a candidate target, the attacker probes plugin-reachable request entry points — the same surfaces any unauthenticated visitor can reach — to locate the operation whose access-control check is missing or misconfigured. No valid account, session cookie, or nonce is required, consistent with PR:N and UI:N. The attacker does not need to defeat an authentication mechanism; the entire premise of CWE-862 is that the operation never required authentication in the first place, or that the check is configured such that an unauthenticated caller satisfies it.

3. Payload and execution at the class level. The attacker issues a crafted request that invokes the affected operation directly, supplying values that would normally be reserved for an authorized actor. Since the flaw is missing authorization rather than injection, the "payload" is not malformed input designed to escape a parser — it is a well-formed request that should have been rejected by an authorization gate and is instead processed. Because confidentiality and availability are both unscored (C:N/A:N), the intended effect is state change rather than data exfiltration or denial of service.

4. Post-exploitation impact. Successful exploitation yields unauthorized modification of plugin-managed data or configuration. Integrity is the sole affected property at High severity. In a booking platform, state modification of this kind can corrupt scheduling records, alter pricing or availability data, or change plugin settings, with downstream effects on business logic and customer-facing accuracy. There is no evidence in the available data that this flaw escalates to code execution, credential theft, or full site takeover; the CVSS scope of Unchanged further argues against cross-boundary compromise.

The absence of exploit tooling and the unpatched status cut in opposite directions for defenders: there is no commodity exploit circulating yet, but there is also no fix, so the vulnerable condition persists on every installation at or below 2.4.10 until the operator intervenes.

Impact Assessment

The CVSS 3.1 base score is 7.5 (High). The contributing metrics are network reachability (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N), which together make the vulnerability trivially reachable by any internet client. The impact subscore is driven entirely by integrity: C:N, I:H, A:N. The exploitability subscore is correspondingly high, while the impact subscore is constrained by the absence of confidentiality and availability effects.

Business impact centers on data trustworthiness rather than data exposure. For organizations running Amelia for appointment, event, or service booking, unauthorized modification of booking state or configuration undermines the accuracy of records that customers and staff rely on, can create fraudulent or disruptive reservations, and can distort pricing, availability, or scheduling logic. Because no confidentiality impact is assessed, this is not a breach-of-secrets scenario; the harm is corruption of operational records and settings.

Blast radius is bounded by the installation. S:U means the vulnerability does not confer control beyond the plugin's own authority. There is no indication of supply-chain propagation, and no evidence of lateral movement capability. However, for a multi-site WordPress deployment or an agency managing many client installations, the same unauthenticated primitive is independently reproducible against every site where the plugin version is in range, so aggregate exposure scales with the number of unpatched installations rather than with any single site's internal complexity.

CISA KEV status is NO, and no active exploitation in the wild is documented. EPSS has not been scored by FIRST.org, so no probabilistic exploitation forecast can be cited; any such figure would be a fabrication. The practical priority is driven by the combination of unauthenticated reachability and the complete absence of a patch, not by observed campaign activity.

Detection Guidance

Sigma Rule

title: Potential Amelia Booking Missing Authorization Exploitation (CVE-2026-96461)
id: 7c1f4a92-3b8e-4d21-9a55-0e6f2d8c1b47
status: experimental
description: Detects unauthenticated or low-privilege requests reaching Amelia booking plugin entry points associated with missing authorization checks in versions <= 2.4.10.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96461
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026-96461
logsource:
  category: webserver
  product: apache
detection:
  selection_plugin:
    cs-uri-query|contains:
      - 'ameliabooking'
      - 'amelia'
  selection_no_auth:
    cs-uri-query|contains: 'action='
    cs-username: '-'
  selection_post:
    cs-method: 'POST'
  condition: selection_plugin and selection_post and selection_no_auth
falsepositives:
  - Legitimate booking submissions from anonymous visitors
  - Automated availability or booking-calendar polling
level: medium

YARA Rule

rule CVE_2026_96461_Amelia_Missing_Auth
{
    meta:
        description = "Detects Amelia booking plugin artifacts referencing affected version range for CVE-2026-96461"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96461"
        severity = "high"

    strings:
        $plugin = "ameliabooking" ascii wide nocase
        $slug1  = "wp-content/plugins/ameliabooking" ascii wide nocase
        $ver1   = "2.4.10" ascii wide
        $ver2   = "2.4." ascii wide
        $cwe    = "Missing Authorization" ascii wide nocase

    condition:
        filesize < 10MB and
        (
            ($plugin or $slug1) and
            ($ver1 or $ver2)
        ) or
        ($plugin and $cwe)
}

Suricata IDS Rule

alert http any any -> any any ( \
  msg:"CVE-2026-96461 Amelia Booking Plugin Missing Authorization Attempt"; \
  flow:established,to_server; \
  http.method; content:"POST"; \
  http.uri; content:"ameliabooking"; nocase; \
  http.header; content:"User-Agent"; \
  reference:cve,2026-96461; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-96461; \
  classtype:attempted-admin; \
  sid:202696461; rev:1; \
  metadata:affected_product "Amelia Booking Plugin", deployment "Perimeter"; \
)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method == "POST" and
      stringContains(http.request.url, "ameliabooking") ]
  [ network where http.request.method == "POST" and
      stringContains(http.request.url, "ameliabooking") and
      not user.name : "*" ]

Splunk SPL Query

index=web sourcetype=access_combined
(uri_path="*ameliabooking*" OR uri_query="*ameliabooking*" OR uri_path="*amelia*")
method=POST
| eval is_anon = if(isnull(cookie) OR NOT match(cookie, "(?i)wordpress_logged_in"), 1, 0)
| where is_anon=1
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri_path) as paths values(src_ip) as source_ips
        by src_ip uri_query
| where count >= 5
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,ameliabooking,">
  <rule id="2026964" level="10">
    <if_sid>31100</if_sid>
    <id>^POST$</id>
    <url>ameliabooking|amelia</url>
    <description>CVE-2026-96461 - Possible Amelia booking plugin missing authorization exploitation attempt (unauthenticated POST to plugin endpoint)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_96461,attack_initial_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4: no patch evidence exists from any tracked source, no vendor advisory has been identified, and no fixed version is documented. Version 2.4.10 must be treated as last-known-vulnerable. Do not assume an upgrade resolves the issue unless the vendor explicitly publishes a fix.

1. Immediate mitigations. Because the flaw is a missing authorization check on an operation exposed to unauthenticated requests, the most effective short-term control is to constrain reachability of the plugin's request surfaces. Place the plugin's administrative and state-changing paths behind authentication at the web server or WAF layer, enforcing a default-deny posture for requests that are not accompanied by a valid authenticated session. Apply virtual patching rules that reject unauthenticated POSTs to plugin endpoints, and rate-limit or challenge anonymous traffic to booking routes. If the plugin is not business-critical on a given site, consider deactivating it until a fix is available. Review plugin-level access-control settings to confirm that no operation intended for staff or administrators is configured to be reachable by anonymous users — the CNA language specifically calls out "incorrectly configured access control security levels," so a settings audit is a legitimate mitigation even without a code fix.

2. Patch and upgrade steps. Monitor the vendor's release channel and the plugin's WordPress.org changelog for a security release above 2.4.10. When a fixed version is published, validate it in a staging environment, take a full backup of files and database, then update production and confirm the plugin version post-update. Absent a vendor fix, do not invent or apply third-party patches to plugin code; unvetted modifications can introduce new defects and will be overwritten on the next update.

3. Long-term hardening. Inventory all WordPress installations and their plugin versions so that exposure to this CVE is measurable rather than assumed. Enforce least-privilege and least-exposure principles for plugin endpoints: any operation that changes state should require authentication and an authorization check. Deploy a WAF with virtual patching capability to buy time between disclosure and vendor fix. Log and alert on unauthenticated requests to plugin endpoints so that exploitation attempts are visible even before a signature exists. Track the CVE in vulnerability management tooling with the explicit note that no patch is available, so that the finding is not silently closed by an unrelated plugin update.

References

1. NVD — CVE-2026-96461: https://nvd.nist.gov/vuln/detail/CVE-2026-96461
2. CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
3. CVSS 3.1 Specification — https://www.first.org/cvss/specification-document
4. MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
5. WordPress Plugin Security Best Practices — https://developer.wordpress.org/plugins/security/

Note on threat actor activity and exploit-in-the-wild evidence: none is documented for CVE-2026-96461. CISA KEV status is NO, no public PoC or exploit code is known, no Nuclei template exists, and EPSS has not been scored by FIRST.org. Any campaign attribution or exploitation-in-the-wild claim would be unsupported by the available data.