The Amelia Booking for Appointments and Events Calendar WordPress plugin versions up to 1.2.19 contain a Full Path Disclosure vulnerability (CWE-200) exploitable through the 'wpAmeliaApiCall' function. This vulnerability allows unauthenticated attackers to retrieve the absolute file system path of the web application. The disclosed information alone is not sufficient to cause damage but may facilitate other attacks if additional vulnerabilities exist. The CVSS 3.1 base score is 5.3 (medium severity), reflecting the low impact of confidentiality loss without integrity or availability impact. No patch or official fix is currently documented.

An attacker can retrieve the full file system path of the web application without authentication. This information disclosure is limited in impact and does not directly affect data integrity or availability. However, it may assist attackers in identifying the environment and planning further attacks if other vulnerabilities are present. There are no known active exploits targeting this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor for updates from the Amelia plugin vendor. Since the vulnerability requires combination with other issues to be harmful, immediate urgent action is not indicated. Avoid exposing the plugin to untrusted networks if possible and consider restricting access to the affected functionality as a temporary measure.