CVE-2022-0825

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other's booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Unknown	Amelia – Events & Appointments Booking Calendar	>= 1.0.49, < 1.0.49

References

https://plugins.trac.wordpress.org/changeset/2693545Patch, Third Party Advisory
https://wpscan.com/vulnerability/1a92a65f-e9df-41b5-9a1c-8e24ee9bf50eExploit, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2693545Patch, Third Party Advisory
https://wpscan.com/vulnerability/1a92a65f-e9df-41b5-9a1c-8e24ee9bf50eExploit, Third Party Advisory

Timeline

Published: Apr 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-08269.8The WP Video Gallery WordPress plugin through 1.7.1 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX CVE-2022-08279.8The Bestbooks WordPress plugin through 2.6.3 does not sanitise and escape some parameters before using them in a SQL statement via an AJAX a CVE-2022-08287.5The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an atta CVE-2022-08298.1Improper Authorization in GitHub repository webmin/webmin prior to 1.990.CVE-2022-08306.5The FormBuilder WordPress plugin through 1.08 does not have CSRF checks in place when creating/updating and deleting forms, and does not san CVE-2022-08315.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.CVE-2022-08325.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.CVE-2022-08334.3The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as requested files, allo CVE-2022-08345.4The Amelia WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the lastName parameter fo CVE-2022-08355.5AVEVA System Platform 2020 stores sensitive information in cleartext, which may allow access to an attacker or a low-privileged user.CVE-2022-08369.8The SEMA API WordPress plugin before 4.02 does not properly sanitise and escape some parameters before using them in SQL statements via an A CVE-2022-08375.4The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing any customer to send