What is the CVSS score of CVE-2026-4668?

CVE-2026-4668 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-4668

EUVD-2026-17727 MEDIUM

SQL Injection (CWE-89)

2026-04-01 security@wordfence.com

WordPress PHP SQLi

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 01, 2026 - 00:22 euvd

EUVD-2026-17727

Analysis Generated

Apr 01, 2026 - 00:22 vuln.today

CVE Published

Apr 01, 2026 - 00:16 nvd

MEDIUM 6.5

DescriptionCVE.org

The Booking for Appointments and Events Calendar - Amelia plugin for WordPress is vulnerable to SQL Injection via the sort parameter in the payments listing endpoint in all versions up to, and including, 2.1.2. This is due to insufficient escaping on the user-supplied sort parameter and lack of sufficient preparation on the existing SQL query in PaymentRepository.php, where the sort field is interpolated directly into an ORDER BY clause without sanitization or whitelist validation. PDO prepared statements do not protect ORDER BY column names. GET requests also skip Amelia's nonce validation entirely. This makes it possible for authenticated attackers, with Manager-level (wpamelia-manager) access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via time-based blind SQL injection.

AnalysisAI

SQL injection in Booking for Appointments and Events Calendar - Amelia WordPress plugin (versions up to 2.1.2) allows authenticated Manager-level users to extract sensitive database information via the sort parameter in the payments listing endpoint. The vulnerability exists because the sort field is interpolated directly into an ORDER BY clause without sanitization, bypassing PDO prepared statement protections which do not cover column names. GET requests also bypass Amelia's nonce validation, enabling time-based blind SQL injection attacks by authenticated users with Manager access or higher.

Technical ContextAI

The vulnerability resides in PaymentRepository.php where user-supplied input from the sort GET parameter is concatenated directly into an SQL ORDER BY clause without sanitization or whitelist validation. While the plugin uses PDO prepared statements for parameter binding, prepared statements do not protect ORDER BY identifiers-only data values. CWE-89 (SQL Injection) occurs when dynamically constructed SQL allows attackers to alter query logic. The affected endpoint is the payments listing handler (GetPaymentsCommandHandler.php), which processes GET requests that skip Amelia's nonce-based CSRF protections. This combination of insufficient input validation on ORDER BY expressions and authentication-only access control creates an exploitable SQL injection point for users with Manager-level WordPress capabilities.

RemediationAI

Update the Booking for Appointments and Events Calendar - Amelia plugin to version 2.1.3 or later, which includes a fix for the SQL injection vulnerability. The fix was implemented in the repository changeset at https://plugins.trac.wordpress.org/changeset/3488955/ameliabooking/trunk/src/Infrastructure/Repository/Payment/PaymentRepository.php. To remediate, navigate to WordPress admin dashboard, go to Plugins, find Amelia, and click Update if available. If automatic updates are not enabled, download version 2.1.3 or newer from https://wordpress.org/plugins/ameliabooking/ and upload manually. As a temporary workaround pending updates, restrict Manager-level WordPress role assignments to trusted administrators only, and monitor access logs for suspicious GET requests to the payments endpoint with unusual sort parameter values.