CVE-2026-9055: CWE-269 Improper Privilege Management in melograno Booking for Appointments and Events Calendar – Amelia

CVE-2026-9055 is a critical privilege escalation vulnerability in the Booking for Appointments and Events Calendar – Amelia (Premium) WordPress plugin. The flaw arises from improper privilege management (CWE-269) due to insufficient validation of the 'type' parameter in the customer update endpoint. Attackers can set their role to 'manager' when the 'externalId' parameter is zero, triggering creation of a WordPress user with the 'wpamelia-manager' role. Subsequently, attackers can escalate privileges to administrator by creating a provider entity linked to an administrator user ID and overwriting the administrator's password. This vulnerability affects versions 8.0 through 9.6.2 of the plugin.

Successful exploitation allows unauthenticated attackers to escalate privileges to administrator level, leading to full control over the affected WordPress site. This includes the ability to modify site content, install malicious plugins, and compromise site integrity and confidentiality. The CVSS v3.1 base score is 9.8, reflecting critical impact on confidentiality, integrity, and availability with network attack vector and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity related to user role changes or provider entity creation. Avoid using affected versions 8.0 through 9.6.2 in production environments.