Amelia Booking CVE-2026-112327

The advisory describes only a generic SQL injection in the Amelia booking plugin through version 2.4.11 and names no specific feature, endpoint, parameter, or configuration setting, so the exact trigger is not disclosed in the provided data. Per the vendor CVSS vector, exploitation requires network access with no authentication (PR:N) and no user interaction (UI:N) against the affected plugin versions. The principal limiting factor is that the target must actually have the Amelia plugin installed and the vulnerable version (<= 2.4.11) deployed and reachable; because Patchstack typically withholds exploit detail pre-disclosure, defenders should treat the specific vulnerable parameter as unknown and prioritize upgrading the plugin.

Signals point to a genuine high priority but with important caveats. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated SQL injection, which for an internet-facing WordPress plugin is a serious combination; the 9.3 score is inflated by the scope-change flag (S:C) and the A:L impact. However, EPSS is not provided in the input, the vulnerability is NOT listed in CISA KEV, and no public exploit is referenced, so there is no evidence of active or at-scale exploitation yet. The I:N in the vendor vector is notable and arguably inconsistent with CWE-89 SQL injection, which commonly permits data modification, not just disclosure - verify impact scope with the vendor/Patchstack. The scope-change (S:C) assignment is also debatable for a classic in-database SQLi and may overstate severity. Net: treat as a high-priority patch target for any site running Amelia <= 2.4.11 because of the unauthenticated network vector and the historical tendency for WordPress plugin SQLi to be reverse-engineered quickly from the patch, but note that 'unauthenticated' rests solely on the vendor-supplied PR:N and the terse description names no specific preconditions.

An attacker identifies a WordPress site running the Amelia booking plugin (version 2.4.11 or earlier) and sends a crafted request to a vulnerable plugin endpoint containing malicious SQL in a parameter that is not properly sanitized. The injected query executes against the WordPress database, allowing extraction of sensitive data such as user credentials, customer booking records, and secret keys. No public proof-of-concept is referenced in the provided data, and the low attack complexity (AC:L) means exploitation requires no special timing or configuration if the endpoint is reachable.