What is the CVSS score of EUVD-2026-43359?

EUVD-2026-43359 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of Amelia are affected by EUVD-2026-43359?

The Amelia booking plugin for WordPress (versions through 2.4.2) contains a critical SQL injection vulnerability exploitable over the network by unauthenticated attackers with no public exploit…

How to fix or mitigate EUVD-2026-43359?

Within 24 hours, inventory all WordPress instances to identify Amelia plugin deployments and current versions. Within 7 days, either disable the plugin or deploy Web Application Firewall rules to block SQL injection patterns; also restrict network access to booking endpoints via IP allowlisting or authentication. Within 30 days, evaluate and execute migration to an alternative booking solution if vendor patch remains unavailable, while continuously monitoring vendor advisories for patch release.

Amelia EUVD-2026-43359

| CVE-2026-57702 CRITICAL

SQL Injection (CWE-89)

2026-07-13 Patchstack

WordPress SQLi Amelia Wordpress Plugin Melograno Venture Studio

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.5 HIGH

Network-reachable blind SQLi with no auth per source vector, primarily confidentiality (data read); no integrity/availability impact and no cross-boundary scope change evident, so S:N/I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:N/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:51 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

CRITICAL 9.3

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Melograno Venture Studio Amelia ameliabooking allows Blind SQL Injection.This issue affects Amelia: from n/a through <= 2.4.2.

AnalysisAI

Blind SQL injection in the Amelia booking plugin for WordPress (Melograno Venture Studio) affects all versions from unknown initial release through 2.4.2, allowing remote attackers to inject crafted SQL into database queries and extract sensitive data via boolean/time-based inference. The CVSS 9.3 vector (AV:N/PR:N) indicates network-reachable exploitation without authentication, though this is a Patchstack-reported issue with no public exploit and no CISA KEV listing at time of analysis. Because the injection is blind, exploitation typically requires automated tooling to reconstruct data one condition at a time.

Technical ContextAI

Amelia is a widely used WordPress appointment/event booking plugin that stores bookings, customer records, service definitions, and payment metadata in the WordPress MySQL/MariaDB database. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input is concatenated into a SQL query without adequate parameterization or escaping, so an attacker can alter the query's logic. The 'blind' qualifier means the vulnerable endpoint does not return query results or verbose SQL errors directly; instead the attacker infers data from differential application behavior (boolean responses) or induced delays (time-based), commonly reached through the plugin's AJAX/REST booking handlers. The affected component is identified by CPE cpe:2.3:a:melograno_venture_studio:amelia:*:*:*:*:*:*:*:*.

RemediationAI

No vendor-released patch version is identified in the provided data, so the primary action is to consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/ameliabooking/vulnerability/wordpress-amelia-plugin-2-4-2-sql-injection-vulnerability) and upgrade Amelia to the first release published after 2.4.2 that Patchstack/Melograno designates as fixed; do not assume 2.4.2 is safe. Until a confirmed fixed version is installed, apply compensating controls: deploy Patchstack's virtual patch or a WAF rule set (e.g. block SQL metacharacters and time-based payloads on the plugin's admin-ajax.php actions and wp-json/amelia REST routes), restrict access to the booking endpoints by IP or authentication where the site's use case permits, and enable database query monitoring/least-privilege for the WordPress DB account to limit exfiltration scope. Trade-offs: aggressive WAF rules on booking parameters can break legitimate reservations and must be tuned, and restricting the public booking endpoints may disable customer self-service, so validate each control against business function before enforcing.