The Amelia plugin for WordPress, used for booking appointments and events, contains an improper authorization vulnerability in all versions up to and including 2.1.2. The flaw arises from a logical short-circuit in the authorization logic that skips token validation for bookings with a 'waiting' status. This allows unauthenticated attackers to approve bookings in 'waiting' status by sending crafted requests to the publicly accessible admin-ajax endpoint.