Amelia CVE-2026-57702

Exploitation targets the Amelia plugin's booking request handling (its admin-ajax.php actions / wp-json Amelia REST endpoints) on any WordPress site running version 2.4.2 or earlier. Per the supplied CVSS vector the attack is network-based, low-complexity, and requires no user interaction and no privileges (PR:N), implying unauthenticated reach against a default install - however, because Amelia SQLi flaws have historically often required a low-privileged authenticated session and the primary description does not name the exact endpoint or precondition, the unauthenticated rating should be confirmed against the Patchstack advisory. Limiting factors: the injection is blind, so extraction is slow and tooling-dependent; exploitation requires the Amelia plugin to be installed and its booking endpoints reachable; and impact is constrained to what the WordPress DB user can access.

The signals are mixed and should temper the raw 9.3 score. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) argues for network, unauthenticated, low-complexity exploitation with high confidentiality impact and a scope change - a genuine high-priority profile for an internet-facing WordPress site. However, no EPSS score, no POC, and no KEV entry are present in the input, so there is no evidence of active or automated exploitation; this is currently a Patchstack advisory disclosure rather than a confirmed exploited threat. The I:N/A:L impact combination is atypical for SQL injection and the S:C scope change is a common Patchstack convention for WordPress-plugin-to-database interaction - both are worth verifying against the primary advisory. Note that many Amelia SQLi issues have historically required at least low-privileged (subscriber/customer) authentication, so the PR:N (unauthenticated) rating should be confirmed with the vendor/Patchstack advisory before assuming pre-auth exposure. Net: treat as a real, prioritize-for-patching issue for any public Amelia deployment, but recognize exploitation status is unproven.

An attacker sends crafted requests to Amelia's public booking AJAX/REST endpoints, embedding blind SQL injection payloads (boolean or time-based) into a vulnerable parameter. By observing differences in response behavior or induced delays, the attacker iteratively reconstructs database contents such as customer PII, booking records, or WordPress user password hashes. No public POC is identified, so a bespoke or automated tool (e.g. sqlmap) would be required.