Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 9.1.2. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated attackers with customer-level permissions or above to change user passwords and potentially take over administrator accounts. The vulnerability is in the pro plugin, which has the same slug.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-03-26 | 4 | Disclosure3General1 |
| 2026-03-27 | 1 | Disclosure1 |
From customer to admin takeover in one request—Amelia Booking Pro flaw enables full WordPress compromise. #CVE-2026-2931 is on the BLS Blog now! https://blog.blacklanternsecurity.com/p/amelia-booking-pro-912-authenticated
Post summary
The post announces CVE-2026-2931, detailing an admin takeover flaw in Amelia Booking Pro, but provides no exploit code or mitigation information.
CVE-2026-2931 The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 9.1.2. This is due to the plugin providing … https://www.cve.org/CVERecord?id=CVE-2026-2931
Post summary
The post reports CVE-2026-2931 affecting Amelia Booking plugin as an IDOR flaw, but contains no PoC, exploit, patch, or evidence of active exploitation.
Amelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change CVE-2026-2931 Channel: https://t.me/KNxploited #CyberSecurity #WordPress #Vulnerability #Exploit #PrivilegeEscalation #Infosec #BugBounty https://t.co/Fi2VAe88KG
Post summary
This tweet announces a new IDOR vulnerability (CVE-2026-2931) in Amelia Booking 9.1.2 that allows authenticated users to change any user's password; no PoC, exploit code, or patch is provided.
[CVE-2026-2931: HIGH] Amelia Booking plugin for WordPress versions up to 9.1.2 has an Insecure Direct Object References vulnerability, allowing authenticated attackers to alter passwords & potentially take ove...#cve,CVE-2026-2931,#cybersecurity https://cvefind.com/CVE-2026-2931
Post summary
The post discloses a high‑severity IDOR vulnerability in Amelia Booking plugin versions up to 9.1.2, enabling authenticated attackers to modify passwords and potentially take system control.
🟠 CVE-2026-2931 - High The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 9.1.2. This is due to the plugin providing user-controlled access t... https://www.thehackerwire.com/vulnerability/CVE-2026-2931/ https://t.co/moabUrNYmO
Post summary
A security advisory identifies a high‑severity Insecure Direct Object Reference vulnerability in Amelia Booking plugin versions up to 9.1.2. The post provides the CVE ID, severity, affected plugin and version, but does not mention exploits, PoC, or patches.