Access violation vulnerability in Booking for Appointments and Events Calendar – Amelia 7.7

The Amelia Premium and Lite plugins for WordPress, which are used to book appointments and manage events, have a security issue that could allow unauthorized access to sensitive data. This is because the function ‘ameliaButtonCommand’ in all versions up to Premium 7.7 and Lite 1.2.3 does not have a capability check. As a result, attackers who are not logged in can view employee calendar information, including OAuth tokens for Google Calendar in the premium version.