CVE-2026-6449 is an improper authorization vulnerability (CWE-285) in the Amelia Booking plugin for WordPress. The flaw arises from a logical short-circuit in the authorization logic that bypasses token validation when a booking is in 'waiting' status. This allows unauthenticated attackers to approve any booking in that status by sending a specially crafted request to the publicly accessible admin-ajax endpoint. The vulnerability affects all versions up to and including 2.1.2. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

An attacker without authentication can approve bookings that are in 'waiting' status, potentially allowing unauthorized confirmation of appointments or events. This could lead to unauthorized access to services or resources managed via the plugin. There is no direct confidentiality or availability impact reported. The vulnerability is rated medium severity with a CVSS score of 5.3. No known exploits have been observed in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting access to the admin-ajax endpoint or implementing additional access controls to prevent unauthorized booking approvals. Monitoring for unusual booking approvals may help detect exploitation attempts.