EUVD-2026-20156
GHSA-x5j5-m454-hv4r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious SQL payload in request parameter
-
DeliverySubmit request as authenticated high-privilege user
-
ExploitExecute blind SQL injection query
-
ExecutionExtract database information through response timing
-
ImpactExfiltrate sensitive data from database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires high-privilege authenticated access to ameliabooking Amelia plugin versions <= 2.1.1. Attacker must be an authenticated user with elevated privileges (administrator or similar role) to inject blind SQL commands through unprotected input fields. |
| Impact | High-severity SQL injection affecting Amelia plugin versions through 2.1.1 with confidentiality impact. Requires authenticated admin access (PR:H), limiting blast radius to trusted insiders or compromised admin accounts. Low observed exploitation activity (EPSS 0.02%) suggests limited real-world deployment pressure currently. Priority depends on admin credential hygiene in WordPress environments. |
| Exploit ScenarioDerived | Authenticated admin accesses plugin settings and injects malicious SQL via vulnerable parameter, extracting database contents through blind SQL injection techniques. No public exploit code identified at time of analysis; attack requires valid administrative WordPress credentials and knowledge of vulnerable input fields. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Blind SQL injection in Amelia WordPress plugin (ameliabooking) version 2.1.1 and earlier allows authenticated privileged users to extract database contents through improper input sanitization. The vulnerability requires high-privilege access (administrator-level) but permits cross-scope impact, enabling extraction of confidential data and potential service disruption. CVSS 7.6 severity reflects network-accessible attack vector with low complexity. No public exploit identified at time of analysis. Low observed exploitation activity (EPSS 0.02%).
RemediationAI
Vendor-released patch status not confirmed in available advisories. Users should immediately check for Amelia plugin updates beyond version 2.1.1 through WordPress admin dashboard or vendor channels. If no patched version is available, deactivate the Amelia plugin until a fix is released to eliminate SQL injection risk. Restrict WordPress administrator access to trusted personnel only as exploitation requires high-privilege credentials. Monitor database query logs for anomalous SELECT statements or time-based delays indicative of blind SQLi attempts. Consult Patchstack advisory for technical details: https://patchstack.com/database/Wordpress/Plugin/ameliabooking/vulnerability/wordpress-amelia-plugin-2-1-1-sql-injection-vulnerability. Review NVD record: https://nvd.nist.gov/vuln/detail/CVE-2026-39487.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-89 SQL injection stemming from insufficient neutralization of special SQL characters in user-controlled input. CVSS vector PR:H indicates exploitation requires high-privilege WordPress administrative credentials. Scope change (S:C) suggests injection may access resources beyond plugin's normal authorization boundary, potentially compromising database integrity across WordPress installation.
Know when Amelia gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Primary rating from Vendor (Patchstack) · only source for this CVE.
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ameliabooking Amelia ameliabooking allows Blind SQL Injection.This issue affects Amelia: from n/a through <= 2.1.1.
Executive ViewAI
A blind SQL injection vulnerability in Amelia WordPress plugin versions 2.1.1 and earlier allows administrators to extract sensitive database contents due to insufficient input validation. Organizations using this plugin must immediately audit administrator account access and implement compensating controls, as no patch is currently available and the vulnerability permits extraction of confidential data including customer and booking information.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict administrator role assignment to essential personnel only; (2) Implement database-level query restrictions and read-only access policies for non-essential admin functions; (3) Enable comprehensive WordPress audit logging for all database queries; (4) Consider temporary plugin deactivation if booking functionality is non-critical; (5) Implement Web Application Firewall (WAF) rules to detect blind SQL injection patterns in plugin parameters.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user
The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in a
Missing Authorization vulnerability in TMS Amelia ameliabooking.0.98. Rated critical severity (CVSS 9.8), this vulnerabi
The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing
The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any cu
The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any cu
Blind SQL injection in the Amelia booking plugin for WordPress (Melograno Venture Studio) affects all versions from unkn
SQL injection in the TMS Amelia booking plugin for WordPress, affecting versions through 2.4.11, lets remote attackers i
Privilege escalation in the Amelia booking plugin for WordPress (versions 2.3 and earlier) allows an authenticated low-p
The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow a
SQL injection in the Amelia WordPress booking plugin (versions ≤ 2.4.9) allows authenticated Editor-role users to exfilt
Unauthenticated sensitive data exposure in the Amelia (Amelia Booking) WordPress plugin versions 2.2 and earlier allows
Exploit-DB