The Amelia Booking plugin for WordPress, including its pro version, suffers from an insecure direct object reference vulnerability (CWE-269) that allows authenticated users with low-level permissions to access and modify objects they should not be authorized to. This flaw enables attackers to change passwords of other users, including administrators, effectively allowing privilege escalation and account takeover. The vulnerability affects versions up to and including 9.1.2. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges at the level of an authenticated user, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

An attacker with at least customer-level access can exploit this vulnerability to bypass authorization controls and change passwords of other users, including administrators. This can lead to full account takeover of privileged accounts, compromising the integrity and availability of the affected WordPress site and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to trusted users only and monitor for suspicious activity related to user account changes. Avoid granting unnecessary permissions to users and consider disabling or removing the vulnerable plugin if possible.