The vulnerability identified as CVE-2026-24963 affects the Amelia booking plugin (ameliabooking) through incorrect privilege assignment, which can lead to privilege escalation. It impacts versions up to 1.2.38. The CVSS 3.1 base score of 7.2 reflects a high-severity issue with network attack vector, low complexity, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability could allow an attacker with some level of access to escalate privileges, potentially gaining unauthorized control over the affected system or application data. The high CVSS score indicates significant potential impact on confidentiality, integrity, and availability of the system. However, no known exploits are reported in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to trusted users and review privilege assignments carefully to minimize risk.