The Amelia plugin for WordPress is vulnerable to unauthorized access of attendee data due to a...

The Amelia plugin for WordPress is vulnerable to unauthorized access of attendee data due to a missing authorization check on the GetEventAttendeesCommandHandler::handle() function in versions up to, and including, 9.9.1. The handler only enforces the broad amelia_read_events capability — which the plugin's own wpamelia-customer role possesses — and does not verify that the authenticated user is an organizer/provider of the event referenced by the client-supplied id query parameter. This makes it possible for authenticated attackers, with wpamelia-customer-level access and above, to export the full CSV of attendee personally identifiable information (first/last name, email, phone, date of birth, gender, private notes, payment amounts/methods, WooCommerce order IDs, custom-field values, and uploaded-file URLs) for any Amelia event on the site by directly invoking the /report/event/attendees endpoint with an arbitrary event ID.