The Booking for Appointments and Events Calendar – Amelia plugins for WordPress suffer from a missing capability check (CWE-862) in the 'ameliaButtonCommand' function. This flaw allows unauthenticated attackers to bypass authorization controls and access employee calendar information, including Google Calendar OAuth tokens in the premium plugin. The vulnerability affects all versions up to Premium 7.7 and Lite 1.2.4. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with no privileges required and no user interaction, resulting in limited confidentiality and integrity impacts but no availability impact.

An unauthenticated attacker can access sensitive employee calendar data, which may include Google Calendar OAuth tokens in the premium version. This exposure can lead to unauthorized access to calendar events and potentially further compromise of linked Google accounts. The integrity and confidentiality of calendar data are impacted, but availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and consider disabling it if possible. Monitor for updates from the vendor and apply patches promptly once available.