Attack Chain

1. An attacker gains customer-level or higher access to a WordPress installation using the Amelia Booking plugin (version 9.1.2 or earlier).
2. The attacker identifies the vulnerable endpoint within the Amelia Booking plugin responsible for user profile management, specifically password reset functionality.
3. The attacker crafts a malicious HTTP request targeting the vulnerable endpoint, manipulating user IDs to target other users, including administrators.
4. Due to the IDOR vulnerability, the plugin fails to properly validate the attacker's authorization to modify the target user's data.
5. The attacker successfully triggers a password reset for the targeted user account by leveraging the manipulated request.
6. The attacker uses the password reset mechanism to set a new password for the target user.
7. The attacker logs into the targeted user's account using the newly set password.
8. If the compromised account is an administrator account, the attacker gains full control over the WordPress installation.

Impact

Successful exploitation of this IDOR vulnerability in the Amelia Booking plugin could result in complete compromise of a WordPress website. An attacker with customer-level access could escalate privileges to an administrator account, leading to data breaches, defacement of the website, or installation of malicious plugins. The impact is high because any authenticated user can potentially escalate privileges. This issue affects all organizations using vulnerable versions of the Amelia Booking plugin.

Recommendation

• Immediately update the Amelia Booking plugin to the latest version, which contains a patch for CVE-2026-2931.
• Monitor web server logs (category webserver, product linux or windows) for suspicious POST requests to the Amelia Booking plugin's endpoints related to user management and password resets.
• Implement rate limiting on password reset functionality to mitigate brute-force attacks and unauthorized password changes.
• Deploy the Sigma rule to your SIEM (below) to detect attempts to exploit this IDOR vulnerability by monitoring for unauthorized modifications to user passwords via HTTP requests.