CVE-2026-9055: CWE-269 Improper Privilege Management in melograno Booking for Appointments and Events Calendar – Amelia

CVE-2026-9055 is a critical privilege escalation vulnerability in the Booking for Appointments and Events Calendar – Amelia (Premium) WordPress plugin. The flaw arises from improper privilege management (CWE-269) due to insufficient validation of the 'type' parameter in the customer update endpoint. Attackers can set their role to 'manager' and create a WordPress user with the wpamelia-manager role when the 'externalId' parameter is 0. This initial escalation allows attackers to create a provider entity linked to an administrator user ID and overwrite the administrator's password, achieving full administrative control. The vulnerability affects versions 8.0 through 9.6.2. The CVSS v3.1 base score is 9.8, reflecting its critical impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to escalate privileges from a customer role to manager, and then to administrator. This results in full administrative control over the WordPress site, including the ability to overwrite administrator passwords. The impact includes complete compromise of site confidentiality, integrity, and availability.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable plugin and monitor for suspicious activity related to role changes and user creation. Avoid exposing the customer update endpoint to untrusted users.