Amelia for WordPress CVE-2026-9055: Update to 9.6.3 or Later — Unauthenticated Admin Takeover

Amelia (Booking for Appointments and Events Calendar – Amelia), a booking plugin for WordPress, has a vulnerability that lets an attacker who is not logged in overwrite an administrator's password and take over that account. It is tracked as CVE-2026-9055.

The short version: if you are running version 8.0 through 9.6.2, update to 9.6.3 or later — the current release is 9.8.1. The fix itself shipped on July 7, 2026, so sites that keep plugins current are already covered.

This article reflects what could be confirmed on September 2, 2026 against the CVE record (assigned by Wordfence), NVD, and the vendor's official changelog.

Do this now

• ✓Open Plugins in the WordPress admin and check the Amelia version number. 8.0 through 9.6.2 is affected — that is the Premium version series, and it does not include the free edition's 2.x releases
• ✓Update to 9.6.3 or later. The current release is 9.8.1 (published August 26, 2026). The Premium edition updates through your wpamelia.com account
• ✓After updating, open the WordPress Users list and look for administrator accounts you did not create
• ✓Change the passwords of your existing administrator accounts and invalidate all login sessions. Updating closes the entry point; it does not undo an account that was already taken
• ✓If your site allows open user registration, reconsider whether it needs to stay open

Where this score comes from. The 9.8 / CRITICAL rating is Wordfence's own CVSS v3.1 assessment as the CNA that assigned this CVE (vector `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`). NVD carries it as the Primary metric, but as of September 2, 2026 the NVD analysis status is still "Received" and NIST has not published its own score. A different version or a different number may appear later.

This vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog (catalog version 2026.09.01), and it has no JVN entry at the time of writing. That is not proof that it is not being exploited, however — it only means the sources checked here (CISA KEV, JVN, the CVE record, and the vendor changelog) say nothing about exploitation.

First, find out whether you are affected

Amelia ships as a free edition and a Premium edition, and the two use separate version series. Confusing them leads either to needless panic or to a missed update.

• ▸The CVE record lists only 8.0 through 9.6.2 as affected — everything else is registered with a default status of unaffected. The NVD description also names the Premium edition specifically
• ▸The Premium edition uses the 8.x / 9.x series. 8.0 through 9.6.2 is affected; 9.6.3 and above is not
• ▸The free edition distributed on WordPress.org ("ameliabooking") uses the 2.x series, and its current release as of September 2, 2026 is 2.4.9. That does not fall inside the 8.0–9.6.2 range
• ▸The free edition reports more than 90,000 active installations on WordPress.org. The product is widely deployed, so it is worth auditing your own and your clients' sites for it

How the attack reaches administrator

Based on the CVE description, the chain runs in four steps. It starts from an unauthenticated position — "we don't have attacker accounts registered as customers" is not a defense here.

• ▸1. The customer update endpoint does not sufficiently validate the attacker-controlled `type` parameter
• ▸2. That allows a customer to set their own role to `manager`
• ▸3. Setting the `externalId` parameter to 0 then triggers creation of a real WordPress user carrying the `wpamelia-manager` role
• ▸4. Creating a provider entity linked to an administrator's user ID lets the attacker overwrite that administrator's password — at which point the admin account is theirs

Losing a WordPress administrator account means losing every piece of site data, every user record, and the ability to run code on the server through theme and plugin editing or upload. The blast radius is not limited to booking data.

The vendor's changelog records 9.6.3 (July 7, 2026) as containing "Resolved a security vulnerability," alongside the note that users should update to that version immediately. The changelog does not cite a CVE number, however. The mapping of 9.6.3 to this specific CVE comes from the CVE record, which registers the affected range as 9.6.2 and below.

Checking whether you were already hit

The vendor has published no workaround. Updating is the remediation. The list below is not an official set of indicators of compromise — it is what the attack chain above would logically leave behind. Finding none of it does not prove you are clean.

• ✓Users you do not recognize carrying the `wpamelia-manager` role in the WordPress Users list
• ✓New Administrator accounts, or existing ones with creation dates you cannot account for
• ✓Password changes or logins you cannot account for on existing administrator accounts
• ✓Entries in Amelia's Customers or Employees (providers) lists that nobody on your team created
• ✓Unexpected themes or plugins on disk, or modification timestamps on existing files that you cannot explain

What to take away from this

There is a gap between the fix shipping and the CVE going public. Here the vendor was notified on May 20, 2026, the fix landed in 9.6.3 on July 7, and the CVE was published on September 2. The sites left exposed at the moment of disclosure are exactly the ones that had been deferring updates. That is the shape the cost of postponed patching takes.

And severity has nothing to do with how small the component is. One booking form plugin was an entry point to full administrator rights over the site. On WordPress, audit themes and plugins not as "parts of the site" but as third-party code running with the site's own privileges. For plugins you no longer use, deleting is safer than deactivating.