WORDPRESS · SEPTEMBER 2026 · EARLY WARNING

Amelia (Premium) WordPress Plugin Privilege Escalation Vulnerability

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: CRITICAL
CVSS: 9.8
Affected component: amelia (premium) wordpress plugin (wordpress)
Patched version: Not yet available

CVE-2026-9055

The Amelia (Premium) WordPress plugin versions 8.0, 9.6.2 are reportedly vulnerable to Privilege Escalation. This allows unauthenticated attackers to escalate their privileges to administrator.

What happened

An early warning has been issued regarding a critical vulnerability in the Amelia (Premium) WordPress plugin. Versions 8.0 through 9.6.2 appear to be affected. The vulnerability, tracked as CVE-2026-9055, allows unauthenticated attackers to escalate their privileges to administrator. This is under investigation and has not been exploited in the wild as of the latest reports.

The vulnerability was first flagged on September 2, 2026. The CVSS score is 9.8, indicating a critical severity level. Users of the affected versions should take immediate action to assess their exposure and apply necessary updates.

What to do about it

Upgrade to the latest version of the Amelia (Premium) WordPress plugin.
Review user roles and permissions to ensure they are correctly configured.
Monitor the NVD page for CVE-2026-9055 for updates on the vulnerability and any official fixes.
Consider implementing additional security measures to protect against potential attacks.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If amelia (premium) wordpress plugin is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

If you are using Amelia (Premium) WordPress plugin versions 8.0 through 9.6.2, you are potentially affected.

What should I do right now?

Upgrade to the latest version of the Amelia (Premium) WordPress plugin and review user roles and permissions.

Has an official fix been released?

No official fix has been published yet. Monitor the sources for updates.

Sources

[CVE-2026-9055] CVSS 9.8 CRITICAL

Join the 0Day waitlist →

← Back to all threats