CVE-2026-16582 Missing authorization in Booking for Appointments and Events Calendar – Amelia
Unauthenticated attackers can create approved appointment bookings without payment by bypassing authorization checks in the Amelia WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-16582?
CVE-2026-16582 is a medium-severity missing authorization vulnerability in melograno Booking for Appointments and Events Calendar – Amelia, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating it. This makes it possible for unauthenticated attackers to create approved appointment bookings without completing payment
Weakness: CWE-862
Which versions are affected by CVE-2026-16582?
How do I fix CVE-2026-16582?
No fix has been published for CVE-2026-16582 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-16582 being exploited?
There is no known exploitation of CVE-2026-16582 in the wild and no public exploit code.
Sources
Also known as GHSA-29vh-pvp9-x94x.