CVE-2025-14720 is a missing authorization vulnerability (CWE-862) in the Amelia Booking plugin for WordPress, affecting all versions up to and including 1.2.38. The vulnerability arises from the absence of proper capability checks on multiple AJAX actions, enabling unauthenticated attackers to manipulate payment statuses, send queued notifications, and access debug data. The CVSS 3.1 score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or official fix has been documented in the provided data.

An unauthenticated attacker can exploit this vulnerability to mark payments as refunded without authorization, potentially disrupting financial records. They can also trigger sending of queued notifications via email, SMS, or WhatsApp, which could be used for spam or social engineering. Access to debug information may reveal sensitive internal details that could aid further attacks. There is no direct confidentiality or availability impact reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin's AJAX endpoints where possible and monitor for unusual activity related to payment status changes and notification triggers. Avoid exposing the plugin's debug information publicly. Follow updates from the Amelia plugin vendor for official patches or temporary mitigations.