Cross-customer data disclosure via unchecked appointment identifier

Authorization bypass in Amelia before 2.4.6 allows remote authenticated users to read other providers' appointment and customer data. The wpamelia_api GET /appointments/{id} route accepts a user-controlled appointment identifier without confirming that the Amelia Employee is assigned to that appointment. An Amelia Employee account and valid nonce are required; sequential identifiers expose names, email addresses, phone numbers, and notes.