Booking for Appointments and Events Calendar Vulnerability – Amelia – Cross-Site Request Forgery – CVE-2024-31425 | WordPress Plugin Vulnerability Report

Plugin Name: Booking for Appointments and Events Calendar – Amelia

Key Information:

  • Software Type: Plugin
  • Software Slug: ameliabooking
  • Software Status: Active
  • Software Author: ameliabooking
  • Software Downloads: 602,133
  • Active Installs: 60,000
  • Last Updated: April 24, 2024
  • Patched Versions: 1.0.96
  • Affected Versions: <= 1.0.95

Vulnerability Details:

  • Name: Amelia <= 1.0.95
  • Title: Cross-Site Request Forgery
  • Type: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
  • CVE: CVE-2024-31425
  • CVSS Score: 4.3
  • Publicly Published: April 10, 2024
  • Researcher: beluga
  • Description: The Amelia plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.0.95. This vulnerability is caused by missing or incorrect nonce validation on a critical function, allowing unauthenticated attackers to execute unauthorized actions via a forged request if they can deceive a site administrator into clicking a link.


The Amelia plugin for WordPress, crucial for managing bookings and appointments, has a vulnerability in versions up to and including 1.0.95 that permits unauthorized actions through forged requests due to inadequate nonce validation. This issue has been addressed in the recently released patch version 1.0.96.

Detailed Overview:

The vulnerability poses a significant risk as it exploits the trust relationship between the website and the user's browser, allowing attackers to manipulate the plugin's functionality. This could potentially result in changes to appointment settings, calendar events, or other critical configurations without the administrator's knowledge. The vulnerability has been patched by improving nonce validation in version 1.0.96, effectively mitigating the risk and securing the plugin against similar attack vectors.

Advice for Users:

  • Immediate Action: Users of the Amelia plugin should update to the patched version 1.0.96 immediately to protect their sites from potential CSRF attacks.
  • Check for Signs of Vulnerability: Administrators should review their site’s logs for any unusual activity or unauthorized changes in appointments and event settings that could indicate this vulnerability was exploited.
  • Alternate Plugins: While the patched version addresses the current vulnerability, users may consider evaluating other booking and calendar plugins with strong security track records as additional precautions.
  • Stay Updated: Consistently updating plugins and other WordPress components is essential for maintaining site security and functionality, preventing vulnerabilities from being exploited.


The rapid resolution of the CSRF vulnerability in the Amelia plugin highlights the importance of ongoing vigilance and prompt software updates. By adhering to the latest security practices and ensuring all components are up-to-date, WordPress site owners can safeguard their operations against emerging threats and maintain a trustworthy digital presence. This case serves as a reminder of the critical nature of nonce validation in securing web applications and the need for comprehensive security strategies in today's digital landscape.


Detailed Report: 

In the interconnected world of web management, the safety of your digital tools is crucial—not just for operational efficiency but for maintaining trust and security. A stark example of this need surfaced recently with the discovery of a significant vulnerability in the widely used "Booking for Appointments and Events Calendar – Amelia" plugin. Identified as CVE-2024-31425, this flaw highlights a critical oversight in security practices that could impact over 60,000 websites relying on Amelia to manage appointments and events.

About the Plugin: Booking for Appointments and Events Calendar – Amelia

The Amelia plugin is a powerful tool designed to streamline the booking and management of appointments and events directly from a WordPress site. Developed by ameliabooking, Amelia has been downloaded over 600,000 times and actively powers 60,000 websites. It is celebrated for its user-friendly interface and robust feature set, which are essential for businesses managing frequent appointments or events.

Vulnerability Details

CVE-2024-31425 exposes a vulnerability in versions up to and including 1.0.95 of the Amelia plugin. This issue arises from improper nonce validation within the plugin’s architecture, specifically impacting the element_pack_ajax_search function. This security gap enables unauthenticated attackers to perform unauthorized actions by forging requests that appear legitimate, thus manipulating the plugin without the site administrator's knowledge.

Risks and Potential Impacts

The risks associated with this vulnerability are significant. Attackers could alter appointment details, manipulate event schedules, or access sensitive information, all without leaving traces that are immediately noticeable to site administrators. Such breaches could lead to data loss, financial damages, and erosion of customer trust, which are particularly detrimental for small businesses relying on their digital presence.

Remediation Steps

To address this vulnerability, the developers released version 1.0.96, which patches the nonce validation issues. Users are urged to update their plugins immediately to this latest version to secure their systems. It’s also recommended that administrators review their site’s activity logs for any unusual activity that might suggest the vulnerability was exploited before the update.

Overview of Previous Vulnerabilities

Since its inception, Amelia has experienced 12 documented vulnerabilities, each promptly addressed by its developers. This history underscores the importance of regular updates and active management of security practices to safeguard against potential exploits.


The swift resolution of the CVE-2024-31425 vulnerability in the Amelia plugin underscores the vital importance of keeping digital tools up-to-date. For small business owners, this incident highlights the necessity of regular maintenance and vigilance, which are key to protecting against security threats in a landscape where digital adversaries are constantly evolving. By staying informed and proactive about updates, businesses can not only defend their operations but also enhance their reliability and trustworthiness in the eyes of their clients.

In our fast-paced digital world, the safety and integrity of your online tools are integral to maintaining not just operational efficiency but also the foundational trust that clients place in your digital presence. This incident with the Amelia plugin serves as a critical reminder of why regular software updates are indispensable.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Booking for Appointments and Events Calendar Vulnerability – Amelia – Cross-Site Request Forgery – CVE-2024-31425 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment