Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment
0Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Track
exploitation probability
—
observed exploitation
nono source reports it
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.
Affected products
Unknown · Booking for Appointments and Events Calendar