Amelia Premium 8.0 – 9.6.2 – Unauthenticated Privilege Escalation to Administrator

CVE-2026-9055 is a critical unauthenticated privilege escalation vulnerability in Amelia Premium, the paid edition of the Booking for Appointments and Events Calendar WordPress plugin. The issue affects Amelia Premium versions 8.0 through 9.6.2 and was published by Wordfence on September 1, 2026, with CVE metadata published on September 2, 2026.

The free Amelia plugin ecosystem has 90,000+ active installations on WordPress.org, but this specific vulnerability is listed for Amelia Premium. Sites using the premium package should update immediately and check for unexpected Amelia manager users or provider records linked to administrator accounts.

Vulnerability summary

• Product: Booking for Appointments and Events Calendar – Amelia Premium
• CVE: CVE-2026-9055
• Affected versions: 8.0 through 9.6.2
• Fixed version: 9.6.3
• Severity: CVSS 9.8 Critical
• Attack class: Improper privilege management, CWE-269
• Required privilege: none
• User interaction: none
• CISA KEV: not listed at publication time

Technical cause

The vulnerable path is in Amelia’s customer update flow. The issue comes from insufficient validation of an attacker-controlled type parameter, which can allow a customer context to become a manager context. When externalId is set to 0, the flow can trigger creation of a WordPress user with the wpamelia-manager role.

Wordfence describes a second step where the attacker creates a provider entity linked to an administrator user ID and overwrites that administrator’s password. That makes the final impact full administrator account takeover, not only access to Amelia booking data.

Immediate remediation

• Update Amelia Premium to 9.6.3 or newer.
• If the update cannot be applied immediately, disable Amelia Premium until the patch is deployed.
• Audit WordPress users with the wpamelia-manager role.
• Review Amelia provider and customer records that are linked to WordPress administrator user IDs.
• Reset administrator passwords and invalidate sessions if suspicious Amelia-linked users or provider mappings are found.
• Check access logs for unauthenticated requests to Amelia customer/provider update endpoints.

Version and user checks

wp plugin list --fields=name,version,status | grep -Ei 'amelia|ameliabooking'
wp user list --role=administrator --fields=ID,user_login,user_email,roles
wp user list --role=wpamelia-manager --fields=ID,user_login,user_email,roles,registered

The Amelia database table prefix can vary by installation. If your table is named wp_amelia_users, this read-only SQL helps locate provider/customer rows linked to WordPress user IDs:

wp db query "SELECT id, type, externalId, email FROM wp_amelia_users WHERE externalId IS NOT NULL ORDER BY id DESC LIMIT 50;"

Review rows where externalId maps to a WordPress administrator. Unexpected provider records linked to administrator IDs should be investigated before any cleanup.

Temporary mitigation

The correct mitigation is to update. If patching is delayed, restrict unauthenticated access to Amelia customer and provider update routes at the WAF or web-server layer, and disable public booking flows that permit customer profile changes until the update is complete.

A practical WAF rule should be scoped to block unauthenticated requests targeting Amelia customer update or provider update actions. Avoid broad blocks against all admin-ajax.php traffic because that can break normal WordPress frontend behavior.

Incident response notes

• Preserve access logs before rotating or deleting suspicious accounts.
• Export the administrator user list and Amelia provider list for comparison.
• Check for new administrator sessions, changed passwords, unfamiliar application passwords, and new plugins or themes.
• Rotate payment, calendar, SMS, and email integration keys if an administrator takeover is confirmed.

Sources

• Wordfence Intelligence: CVE-2026-9055
• OpenCVE: CVE-2026-9055
• Amelia changelog
• WordPress.org Amelia plugin page