CVE-2026-6449 describes an improper authorization vulnerability (CWE-285) in the Amelia Booking plugin for WordPress versions up to 2.1.2. The flaw arises from a logical short-circuit in the authorization logic that bypasses token validation when a booking is in 'waiting' status. This allows unauthenticated attackers to approve bookings by sending crafted requests to the publicly accessible admin-ajax endpoint, potentially altering booking statuses without proper authorization.

The vulnerability allows unauthorized modification of booking statuses from 'waiting' to approved without authentication. This could lead to unauthorized approvals of appointments or events, potentially disrupting scheduling or allowing fraudulent bookings. There is no indication of confidentiality or availability impact. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting access to the admin-ajax endpoint or implementing additional access controls to prevent unauthorized requests targeting booking approval functionality.