What is the CVSS score of CVE-2026-39487?

CVE-2026-39487 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Amelia are affected by CVE-2026-39487?

A blind SQL injection vulnerability in Amelia WordPress plugin versions 2.1.1 and earlier allows administrators to extract sensitive database contents due to insufficient input validation.

How to fix or mitigate CVE-2026-39487?

Within 24 hours: Identify all WordPress instances running Amelia plugin versions ≤2.1.1 and document current administrator accounts with access. Within 7 days: Implement database access controls restricting administrator query scope, enable WordPress admin activity logging, and consider disabling the plugin if non-critical. Within 30 days: Monitor vendor (Elfsight) for patch release to version 2.1.2 or later; apply immediately upon availability. Conduct database access audit for unauthorized query history.

Amelia CVE-2026-39487

EUVD-2026-20156 HIGH

SQL Injection (CWE-89)

2026-04-08 Patchstack

GHSA-x5j5-m454-hv4r

SQLi Amelia

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20156

Analysis Generated

Apr 08, 2026 - 08:45 vuln.today

CVE Published

Apr 08, 2026 - 08:30 nvd

HIGH 7.6

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ameliabooking Amelia ameliabooking allows Blind SQL Injection.This issue affects Amelia: from n/a through <= 2.1.1.

AnalysisAI

Blind SQL injection in Amelia WordPress plugin (ameliabooking) version 2.1.1 and earlier allows authenticated privileged users to extract database contents through improper input sanitization. The vulnerability requires high-privilege access (administrator-level) but permits cross-scope impact, enabling extraction of confidential data and potential service disruption. CVSS 7.6 severity reflects network-accessible attack vector with low complexity. No public exploit identified at time of analysis. Low observed exploitation activity (EPSS 0.02%).

Technical ContextAI

CWE-89 SQL injection stemming from insufficient neutralization of special SQL characters in user-controlled input. CVSS vector PR:H indicates exploitation requires high-privilege WordPress administrative credentials. Scope change (S:C) suggests injection may access resources beyond plugin's normal authorization boundary, potentially compromising database integrity across WordPress installation.

RemediationAI

Vendor-released patch status not confirmed in available advisories. Users should immediately check for Amelia plugin updates beyond version 2.1.1 through WordPress admin dashboard or vendor channels. If no patched version is available, deactivate the Amelia plugin until a fix is released to eliminate SQL injection risk. Restrict WordPress administrator access to trusted personnel only as exploitation requires high-privilege credentials. Monitor database query logs for anomalous SELECT statements or time-based delays indicative of blind SQLi attempts. Consult Patchstack advisory for technical details: https://patchstack.com/database/Wordpress/Plugin/ameliabooking/vulnerability/wordpress-amelia-plugin-2-1-1-sql-injection-vulnerability. Review NVD record: https://nvd.nist.gov/vuln/detail/CVE-2026-39487.