EUVD-2026-45051
GHSA-x744-9h4c-fvj9
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
PR:H confirmed by wpamelia-manager role requirement; C:H reflects full DB read access; I:N and A:N because exploitation enables data extraction only.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Booking for Appointments and Events Calendar - Amelia plugin for WordPress is vulnerable to SQL Injection via the Customer Import in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with wpamelia-manager role, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL Injection in the Amelia booking plugin for WordPress (versions through 2.4.3) allows authenticated attackers holding the wpamelia-manager role to exfiltrate arbitrary data from the site's database via the Customer Import feature. The flaw stems from unsanitized user-supplied parameters passed into pre-existing SQL queries without adequate escaping or prepared statement usage, enabling stacked or appended query manipulation. No public exploit code or active exploitation has been identified at the time of analysis, and the confidentiality-only impact (C:H/I:N/A:N) reflects read-level database access rather than modification or destruction capability.
Technical ContextAI
The vulnerability resides in the Amelia booking plugin (CPE: cpe:2.3:a:melograno:booking_for_appointments_and_events_calendar_-_amelia:*:*:*:*:*:*:*:*) developed by Melograno and distributed via the WordPress plugin repository. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically in the Customer Import functionality. Source code evidence is available at plugins.trac.wordpress.org in the 2.4.3 tag at src/Infrastructure/Repository/User/UserRepository.php line 476, where user-supplied input is incorporated into SQL queries without proper parameterized query binding or sufficient output escaping. The lack of prepared statements is the proximate cause - rather than binding parameters at the database driver level, the plugin constructs queries by string concatenation, making it trivial for an attacker to alter query logic. The vulnerability is network-reachable because WordPress admin and manager functions are exposed over HTTP.
RemediationAI
Update the Amelia plugin to a version beyond 2.4.3 through the WordPress plugin dashboard or by downloading directly from the WordPress plugin repository. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a58e68-d1f1-4d4f-ac64-bc6cb7dbdbfc should be consulted for the confirmed patched version, as the exact fix version was not independently confirmed in the available data. If immediate patching is not possible, restrict the wpamelia-manager role to fully trusted users only - removing it from any accounts not strictly requiring it eliminates the attack surface entirely since exploitation requires that specific role. Additionally, deploying a WordPress-aware Web Application Firewall (such as Wordfence's own firewall) with SQLi rulesets can detect and block injection attempts as a compensating control, though this should not substitute for patching. Database user privilege restriction (limiting the WordPress DB user to only SELECT/INSERT/UPDATE on required tables) can reduce the blast radius of successful exploitation.
Unauthenticated privilege escalation in the WordPress plugin Booking for Appointments and Events Calendar - Amelia (Prem
Stored XSS in the Amelia WordPress booking plugin (versions ≤ 2.2) allows unauthenticated attackers to persist malicious
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today