Now officially on WordPress.org

CVE Database / CVE-2022-0687

CVE · High

CVE-2022-0687 — Booking for Appointments and Events Calendar – Amelia [ameliabooking] < 1.0.47

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2022-0687 Booking for Appointments and Events Calendar – Amelia [ameliabooking] < 1.0.47 Unrestricted Upload of File with Dangerous Type High 8.8 < 1.0.47 1.0.47 2022-02-23 —

CVE-2022-0687

The Amelia booking plugin versions prior to 1.0.47 contains a file upload vulnerability where user-controlled input determines the file extension assigned to uploaded image data, potentially allowing attackers to write executable PHP files to the server. Users with the custom "Amelia Manager" role can exploit this flaw to upload malicious code and establish backdoor access to the website.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings