** Two flaws published on 7 November 2026 let low-privilege users export other people's booking records from WordPress sites running the Amelia appointments and events plugin, version 9.9.1 or older. The flaws, tracked as CVE-2026-107616 and CVE-2026-104992, were assigned by Wordfence, which rates the first at CVSS 7.5, high severity.

How the data leak works

The plugin's report endpoints check only a broad capability that the plugin's own customer role already holds, and never verify that the user organises or takes part in the event named in the request. An authenticated attacker with a customer-level account can therefore call the endpoint with any event ID and download a full CSV of attendee records, including names, email addresses, phone numbers, dates of birth, private notes, payment amounts and methods, WooCommerce order IDs and uploaded-file links. The second flaw works the same way against booking records, exposing booking status, prices, payment status and coupon codes.

Who is affected

Any site running Amelia up to and including version 9.9.1 is affected. The plugin is widely used by clinics, salons, gyms and event organisers, so the exposed records can include health-adjacent and payment details that make the leak serious for both site owners and their customers. No patched version was named in the published CVE records checked for this story, so site owners should check the vendor changelog and update as soon as a fixed release is available.

What site owners should do now

Until a fix is installed, owners should review which accounts hold the customer role and limit who can register one, and watch their logs for unusual report-endpoint requests. Visitors who booked through an Amelia site should be alert for phishing that uses their real booking details. Sources: [OpenCVE](https://opencve.mandarin-it.de/cve/CVE-2026-107616) and [Wordfence](https://www.wordfence.com/threat-intel/vulnerabilities/id/c0a43f7f-1314-4894-aaf1-b7ef0f3e6217?source=cve).