CVE-2022-0837

The Amelia plugin prior to version 1.0.48 fails to properly validate user permissions when managing the SMS service feature, enabling unauthenticated customers to dispatch billable test SMS messages and access confidential administrative data including email addresses, account balances, and transaction records. An attacker could exploit this flaw to deplete the account balance through repeated SMS transmissions.

Based on public CVE data (MITRE/NVD).