The Booking for Appointments and Events Calendar WordPress plugin versions prior to 2.4.10 do not properly verify whether a user editing a customer or employee record has the right to modify the linked WordPress account. This lack of verification permits users with Amelia's customer or employee management permissions to change the password and email address of other users' WordPress accounts, facilitating account takeover. The vulnerability is identified as CWE-639 (Authorization Bypass Through User-Controlled Key).

Successful exploitation allows an attacker with limited management permissions within the plugin to take over other WordPress user accounts by changing their passwords and email addresses. This leads to full compromise of affected user accounts, including confidentiality, integrity, and availability impacts as indicated by the CVSS score of 7.2 (high severity).

Upgrade the Booking for Appointments and Events Calendar WordPress plugin to version 2.4.10 or later, where this authorization verification issue has been fixed. No other mitigation is required once the plugin is updated.