CVE-2026-48889: WordPress Amelia plugin <= 2.3 - Privilege Escalation vulnerability

Synopsis

This is a privilege escalation vulnerability in the Amelia WordPress plugin, versions 2.3 and below. It is reachable over the network and requires only a low-privilege account (such as a standard subscriber), with no additional user interaction needed. Successful exploitation allows an attacker to elevate their permissions within the application, gaining the ability to read, modify, or delete data and disrupt service availability. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as the upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker must be able to send HTTP requests to the target WordPress installation.

• AuthenticationRequired

  A low-privilege account, such as a standard WordPress subscriber, is sufficient to trigger the escalation; no admin credentials are needed.

• Victim interactionNot required

  No action from another user or administrator is needed; the attacker can exploit the vulnerability entirely on their own.

• Attack complexityDetail

  Exploit complexity is low, meaning the attack is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• A successful attacker gains elevated permissions within the WordPress application, likely reaching administrator-level capabilities.
• With elevated access, the attacker can read sensitive site data including user records, booking information, and stored credentials managed by Amelia.
• The attacker can modify or delete plugin data, site content, and WordPress configuration, including persisted database rows.
• The attacker can disrupt availability of the site or the Amelia booking service by altering settings, removing data, or installing malicious plugins.