Amelia WordPress Plugin CVE-2026-14782

Exploitation requires the attacker to possess an authenticated WordPress session with the wpamelia-manager role specifically assigned - standard WordPress Administrator, Editor, or lower roles are not sufficient unless they have also been assigned this plugin-specific role. The Customer Import feature within the Amelia plugin must be accessible to the manager account. The Amelia plugin must be installed, active, and at version 2.4.3 or earlier. What limits exploitation: PR:H authentication requirement rules out unauthenticated and low-privilege attackers; the attacker needs either legitimate manager credentials or a path to compromise such an account first; impact is read-only (I:N/A:N), so the attacker cannot modify or delete data through this vector alone; no scope change means lateral movement to other systems requires separate steps.

The CVSS 3.1 score of 4.9 (Medium) is defensible and proportionate for this vulnerability. The vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N correctly captures that exploitation requires elevated authentication (PR:H - specifically the wpamelia-manager role) over a network with low complexity, but results only in confidentiality compromise with no integrity or availability impact. Real-world risk is meaningfully constrained by the PR:H requirement: an attacker must first obtain a valid wpamelia-manager account, which limits opportunistic exploitation. No EPSS score was provided in the supplied data, so exploitation probability cannot be quantified from that signal. KEV status is not listed, meaning CISA has not confirmed active exploitation. No public POC has been identified. The practical threat scenario is most likely an insider, a compromised manager-level account, or a privilege-chaining attack where this SQLi is a secondary tool after initial access. The C:H rating is credible - WordPress database tables frequently contain user PII, email addresses, credentials, payment metadata references, and booking data. This is a real issue for sites handling sensitive customer information but is not an emergency for most deployments given the authentication barrier.

An attacker who has obtained or been granted a wpamelia-manager account on the target WordPress site navigates to the Customer Import functionality and submits a crafted CSV or import payload containing SQL metacharacters designed to append a secondary query (e.g., UNION SELECT or stacked query) to the existing database call in UserRepository.php. The injected query extracts targeted rows - such as WordPress user hashes, stored customer PII, or booking payment metadata - and returns the data in the import response or an error message. No public exploit code has been identified, but the technique is well-understood and the source code is publicly visible.