CVE-2022-0687: tms-outsource amelia
Vulnerability summary
CVE-2022-0687 is a high (CVSS 8.8) vulnerability in tms-outsource amelia. EPSS estimates a 1.46% chance of exploitation in the next 30 days, higher than 73.1% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.0.47.
Timeline
- 21-03-2022PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role.
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.46%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
0.00 pp
From 1.46% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Tms-outsource1 product
- amelia< 1.0.47
Unknown1 product
- amelia – events & appointments booking calendar≥ 1.0.47, < 1.0.47
Wordpress1 product
- ameliabooking< 1.0.47
3 vendors · 3 products
References
2 links- wpscan.com/vulnerability/3cf05815-9b74-4491-a935-d69a0834146cX Refsource MISCExploitThird Party Advisory