VulnSocial

CVE-2026-9055Disclosure

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint, which allows customers to set their role to 'manager' and trigger creation of a WordPress user with the wpamelia-manager role when the 'externalId' parameter is set to 0. This makes it possible for unauthenticated attackers to escalate their privileges to administrator by first elevating to the manager role, then creating a provider entity linked to an administrator user ID and overwriting that administrator's password.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-269

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 5 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked 3d ago at 2 mentions (2026-09-02); latest day: 1
  • 5 total mentions across 4 days

Deep dive

Activity timeline5 mentions / 4d
01122Mentions · 2026-09-02: 2Mentions · 2026-09-03: 1Mentions · 2026-09-09: 1Mentions · 2026-09-14: 1Patch / Workaround · 2026-09-09: 1Patch / Workaround · 2026-09-14: 1Technical Details · 2026-09-02: 2Technical Details · 2026-09-14: 109-0209-0309-0909-14
Signal classification2 categories
Disclosure
360.0%
Patch
240.0%
Referenced assets6 URLs
Classification over time
DateTotalLabels
2026-09-022
Disclosure2
2026-09-031
Disclosure1
2026-09-091
Patch1
2026-09-141
Patch1
Full discourse5 posts
  • KMO.partners@Kmo_Partners
    Patch

    Amelia Premium tot 9.6.2: update naar 9.6.3 tegen site-overname https://www.kmo.partners/2026/09/14/amelia-premium-cve-2026-9055-update-9-6-3/ https://www.kmo.partners/wp-content/uploads/2026/09/amelia-premium-cover.jpg #amelia #boekingen #cve-2026-9055 #cyberveiligheid #patch #software #wordpress https://t.co/4ExzlYXp0l

    Post summary

    The post highlights CVE-2026-9055 affecting Amelia Premium versions up to 9.6.2 and recommends updating to 9.6.3 to prevent site takeover.

    0000057
    9 followersView on X
  • Phil_Taboada@Phil24275443
    Patch

    Si usas Amelia Premium para citas (8.0 a 9.6.2), actualiza a 9.6.3. Sin login podían tomar el admin. Si no puedes, cierra el booking. Si no, el panel deja de ser tuyo. https://www.wavys-technologies.com/es/blog/amelia-premium-cve-2026-9055

    Post summary

    Se alerta sobre una falla en Amelia Premium (v8.0‑9.6.2) que permite tomar control de administrador sin login, y se aconseja actualizar a la versión 9.6.3.

    0000035
    3 followersView on X
  • CERT-PY@CERTpy
    Disclosure

    ⚠️ Vulnerabilidades en Complementos de WordPress ❗ CVE-2026-9055 ❗ CVE-2026-78657 ❗ CVE-2026-14357 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-complementos-de-wordpress/ https://t.co/na9Tq4jZVC

    Post summary

    A brief announcement lists three WordPress plugin CVEs and directs readers to a CERT website for further info.

    00000230
    6.7K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-9055 The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to i… https://www.cve.org/CVERecord?id=CVE-2026-9055

    Post summary

    The post announces CVE‑2026‑9055 for the Amelia WordPress plugin, highlighting a privilege escalation flaw in certain versions, but lacks PoC, exploit, or patch information.

    000001.4K
    58.0K followersView on X
  • LoreleiWeb@LoreleiWeb
    Disclosure

    🆕👉 Amelia Premium 8.0 – 9.6.2 – Unauthenticated Privilege Escalation to Administrator https://wpdeeply.com/amelia-premium-9-6-2-unauthenticated-privilege-escalation-administrator/ #loreleiweb CVE-2026-9055 is a critical unauthenticated privilege escalation vulnerability in Amelia Premium, the paid edition of the Booking for Appointments and E… https://t.co/VzzKtDlC3K

    Post summary

    The tweet announces CVE-2026-9055, a critical unauthenticated privilege escalation vulnerability in Amelia Premium 8.0–9.6.2, but lacks PoC, exploit details, patch information, or active exploitation evidence.

    00000211
    85.9K followersView on X

Explore more

Back to dashboard