High severity · published Sep 12, 2026
CVE-2026-77705
Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover
7.2
CVSS
0.5%
EPSS
No
On KEV
Description
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BF
Booking for Appointments and Events Calendar ·
before 2.4.10 · source: vendor
Affected product
BF
Booking for Appointments and Events Calendar
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-77705
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-77705
wpscan.com
https://wpscan.com/vulnerability/bfd0ce74-f91e-41fe-8288-7b1d34dd16fe/
More from Booking for Appointments and Events Calendar
6.5
CVE-2026-14215
Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger
6.5
CVE-2026-14216
Amelia < 2.4.7 - Unauthenticated Notification Queue Dispatch
5.3
CVE-2026-77689
Amelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass
4.7
CVE-2026-14212
Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR
3.8
CVE-2026-14211
Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR