CVE-2026-9055

CVE-2026-9055 is a critical (CVSS 9.8) unauthenticated privilege escalation flaw (CWE-269) in the Amelia (Premium) appointments and events booking plugin for WordPress, affecting versions 8.0 through 9.6.2. It stems from insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint: an attacker can get the plugin to treat them as a manager, and when the 'externalId' parameter is set to 0 a WordPress user with the 'wpamelia-manager' role is created. From the manager role, the attacker can then create a provider entity linked to an administrator's user ID and overwrite that administrator's password, gaining full administrator access to the site. Any WordPress site running Amelia Premium in the affected version range is exposed, with risk highest where the plugin's customer-update endpoint is reachable by anonymous visitors (its typical default deployment). No public proof-of-concept is known, the flaw is not in CISA's KEV, and EPSS is low at 0.3%, so exploitation has not been confirmed.

What to do: Upgrade Amelia Premium to the latest vendor release (anything newer than 9.6.2; the exact patched version is not specified in the available data). Until patched, restrict anonymous access to the Amelia customer-update endpoint and audit sites for unexpected WordPress accounts with the wpamelia-manager role, provider entities linked to administrator user IDs, and unexplained administrator password changes or new admin accounts.