This vulnerability in ameliabooking Amelia allows an attacker to bypass authorization controls by exploiting improperly configured access control mechanisms involving a user-controlled key. The affected versions include all versions up to 1.2.16. The vulnerability was published on February 25, 2025, but no CVSS score or patch information is currently available. The vulnerability does not affect cloud services and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to bypass authorization controls, potentially gaining unauthorized access to restricted functionality or data within the affected Amelia booking plugin. The exact impact depends on the privileges accessible through the bypass but is generally considered a serious security concern due to the nature of authorization bypass.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates and consider restricting access to the affected plugin or implementing compensating controls to limit exposure.