CVE-2026-6449: 
WordPress vulnerability analysis and mitigation

CVE-2026-6449 is an Improper Authorization vulnerability in the Booking for Appointments and Events Calendar – Amelia plugin for WordPress, affecting all versions up to and including 2.1.2. The flaw stems from a logical short-circuit in the authorization logic that causes token validation to be entirely skipped when a booking has a 'waiting' status, allowing unauthenticated attackers to approve any such booking via the publicly-accessible admin-ajax endpoint. It was published on May 2, 2026, with the advisory assigned by Wordfence. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-285 (Improper Authorization). The vulnerability exists in the ApproveBookingRemotelyCommandHandler.php and ApproveBookingRemotelyController.php files, where the authorization logic contains a logical short-circuit flaw: when a booking's status is 'waiting', the token validation step is bypassed entirely rather than enforced (GitHub Advisory). An unauthenticated attacker can exploit this by sending a crafted HTTP request to the WordPress admin-ajax endpoint targeting the remote booking approval action, supplying a valid booking ID with 'waiting' status — no authentication token is required. The vulnerable code paths are documented in UserApplicationService.php#L647, ApproveBookingRemotelyCommandHandler.php#L97, and ApproveBookingRemotelyController.php#L41 (Wordfence).

Successful exploitation allows unauthenticated attackers to manipulate the status of any booking in 'waiting' state, approving it without authorization. The primary impact is on integrity — attackers can subvert appointment scheduling workflows, potentially enabling unauthorized access to services, bypassing waitlists, or disrupting business operations that rely on manual booking approval. There is no confidentiality or availability impact, and the scope is limited to the affected WordPress plugin's booking data (GitHub Advisory, Wordfence).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.014% (0.025% per GitHub Advisory), placing it in a low exploitation-probability tier. The vulnerability is remotely exploitable with no authentication or user interaction required, which lowers the barrier for opportunistic abuse. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the Amelia booking plugin (versions ≤ 2.1.2) using tools like WPScan, Shodan, or by checking publicly visible plugin metadata in the site's source code.
2. Identify target bookings: Enumerate or guess booking IDs that are in 'waiting' status. Booking IDs may be sequential or discoverable through booking confirmation emails or public-facing calendar interfaces.
3. Craft malicious request: Send an HTTP POST or GET request to the site's wp-admin/admin-ajax.php endpoint, targeting the remote booking approval action (e.g., action=ameliaApproveBookingRemotely) with the target booking ID as a parameter, omitting or providing an invalid authorization token.
4. Bypass token validation: Due to the short-circuit flaw, the server skips token validation for bookings in 'waiting' status and processes the approval request as legitimate.
5. Booking approved: The targeted booking transitions from 'waiting' to 'approved' status without any authorization, potentially granting the attacker or a third party access to a reserved appointment slot (GitHub Advisory, Wordfence).

• Network: Unusual or repeated HTTP requests to wp-admin/admin-ajax.php with Amelia booking approval action parameters (e.g., action=ameliaApproveBookingRemotely) originating from unauthenticated or unknown IP addresses.
• Logs: WordPress access logs showing POST/GET requests to admin-ajax.php with booking approval parameters and no associated authenticated session cookie; multiple rapid approval requests for different booking IDs from the same IP.
• Application Data: Unexpected transitions of bookings from 'waiting' to 'approved' status in the Amelia plugin database (wp_amelia_customer_bookings table), especially outside of normal business hours or without corresponding admin activity in WordPress audit logs.

Update the Amelia plugin to a version newer than 2.1.2, which contains the fix for the authorization logic flaw (GitHub Advisory, Wordfence). The patch changeset is available in the WordPress plugin repository. As a temporary workaround where immediate patching is not possible, consider implementing WAF rules to restrict access to the admin-ajax.php endpoint for unauthenticated users, or temporarily disabling the remote booking approval feature. Organizations should audit all WordPress installations for this plugin and prioritize patching across all affected instances (Sucuri Blog).

Wordfence included CVE-2026-6449 in its weekly WordPress vulnerability report for the period of April 27–May 3, 2026, noting the authorization bypass as a notable finding (Wordfence Blog). Sucuri also referenced the vulnerability in its May 2026 vulnerability patch roundup (Sucuri Blog). Community reaction has been measured given the moderate severity score and lack of active exploitation evidence.