Summary
CVE-2026-9055 is a critical privilege escalation vulnerability (CWE-269) in Amelia (Premium), a WordPress booking plugin for appointments and events, affecting versions 8.0 through 9.6.2. The flaw sits in the plugin's customer-update endpoint, which fails to properly validate the attacker-controlled type parameter. By crafting a request that sets externalId to 0, an attacker can flip their own account into the wpamelia-manager role — the first step in a chain that ends in full site takeover.
The plugin has 90,000+ active installs.
Vulnerability Details
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-9055 |
| CVSS Score | 9.8 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CWE | CWE-269 — Improper Privilege Management |
| Type | Privilege Escalation via unvalidated type/externalId parameters |
| Attack Vector | Network |
| Privileges Required | None |
| User Interaction | None |
| Vendor | Amelia (WPAmelia / TMS) |
| CNA | Wordfence |
Affected Versions
| Product | Affected Versions | Notes |
|---|---|---|
| Amelia (Premium) | 8.0 – 9.6.2 | WordPress.org's public changelog lists v9.6.3 (released July 7, 2026) as fixing "a security vulnerability" without citing a CVE — consistent with, but not independently confirmed as, the fix for this CVE. |
Site owners should update to the latest available Amelia release regardless, given the severity of this record.
Attack Chain and Root Cause
1. Attacker submits a crafted request to Amelia's customer-update endpoint
2. The 'type' parameter is not properly validated against the caller's
actual privileges
3. Setting 'externalId' to 0 causes the endpoint to assign the requesting
account the customer role 'manager', creating a WordPress user with
the 'wpamelia-manager' capability set
4. As a manager, the attacker creates a new Amelia 'provider' entity and
links it to an existing administrator's WordPress user ID
5. That linkage lets the attacker overwrite the administrator's password,
handing them full control of the WordPress siteMultiple vulnerability-intelligence sources describe this chain as reachable without authentication, meaning the entry point — the customer-update endpoint — does not require a valid session before the type/externalId manipulation succeeds.
Impact of Successful Exploitation
| Impact | Description |
|---|---|
| Account Takeover | Attacker gains the wpamelia-manager role from an unauthenticated starting position |
| Administrator Compromise | Manager-level access allows overwriting an admin's password directly |
| Full Site Takeover | Administrator access on WordPress means arbitrary plugin/theme installation and full content control |
Remediation
- Update Amelia immediately to the latest version available from the plugin vendor or WordPress.org.
- Audit user accounts for any unexpected
wpamelia-managerrole assignments or newly created administrator accounts. - Review Amelia "provider" entities for any linked to administrator user IDs that your team did not create.
- Force a password reset for all administrator accounts if the plugin was running an affected version (8.0–9.6.2) with public-facing booking forms enabled.
- Restrict or temporarily disable the Amelia customer-facing booking flow if immediate patching isn't possible.
Detection Indicators
| Indicator | Description |
|---|---|
Unexpected wpamelia-manager role grants | Sign of the initial escalation step |
| New Amelia provider records linked to admin user IDs | Sign of the privilege-linkage step |
| Administrator password changes with no corresponding legitimate reset request | Sign of the final takeover step |
| Unfamiliar administrator accounts | Post-exploitation persistence |