https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 22:04:13 +0000 https://vulnerability.circl.lu/vuln/cve-2026-9055 <p><strong>Affected:</strong> melograno Booking for Appointments and Events Calendar – Amelia</p> <p>The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled &#39;type&#39; parameter in the customer update endpoint, which allows customers to set their role to &#39;manager&#39; and trigger creation of a WordPress user with the wpamelia-manager role when the &#39;externalId&#39; parameter is set to 0. This makes it possible for unauthenticated attackers to escalate their privileges to administrator by first elevating to the manager role, then creating a provider entity linked to an administrator user ID and overwriting that administrator&#39;s password.</p> <p><strong>Affected:</strong> melograno Booking for Appointments and Events Calendar – Amelia</p> <p>The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled &#39;type&#39; parameter in the customer update endpoint, which allows customers to set their role to &#39;manager&#39; and trigger creation of a WordPress user with the wpamelia-manager role when the &#39;externalId&#39; parameter is set to 0. This makes it possible for unauthenticated attackers to escalate their privileges to administrator by first elevating to the manager role, then creating a provider entity linked to an administrator user ID and overwriting that administrator&#39;s password.</p> https://vulnerability.circl.lu/vuln/cve-2026-9055