EUVD-2026-76208
GHSA-qgwf-cmr2-fmwh
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
PR:H reflects mandatory Editor-role authentication; S:C and C:H capture cross-database read impact; I:N consistent with read-only injection path indicated by vendor score.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Editor SQL Injection in Amelia <= 2.4.9 versions.
AnalysisAI
SQL injection in the Amelia WordPress booking plugin (versions ≤ 2.4.9) allows authenticated Editor-role users to exfiltrate data from the underlying database via crafted queries. The vulnerability is scoped-changed, meaning successful exploitation reaches beyond the plugin component to the WordPress database. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active WordPress account with the Editor role (or higher) on the target installation - unauthenticated exploitation is not possible per the PR:H CVSS metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.6 score reflects a real but access-gated risk: PR:H (Editor role required) significantly limits the attacker pool to users with legitimate elevated access to the WordPress installation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Amelia plugin to a version greater than 2.4.9 - Patchstack confirmed the vulnerability exists in ≤ 2.4.9, so any vendor-released version beyond that threshold constitutes the primary fix; consult the Patchstack advisory at the reference URL for the confirmed patched release number. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress installations using Amelia plugin ≤2.4.9 and immediately restrict Editor-role access to only personnel with documented business justification. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user
The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in a
Missing Authorization vulnerability in TMS Amelia ameliabooking.0.98. Rated critical severity (CVSS 9.8), this vulnerabi
The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing
The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any cu
The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any cu
Blind SQL injection in the Amelia booking plugin for WordPress (Melograno Venture Studio) affects all versions from unkn
Privilege escalation in the Amelia booking plugin for WordPress (versions 2.3 and earlier) allows an authenticated low-p
The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow a
Blind SQL injection in Amelia WordPress plugin (ameliabooking) version 2.1.1 and earlier allows authenticated privileged
Unauthenticated sensitive data exposure in the Amelia (Amelia Booking) WordPress plugin versions 2.2 and earlier allows
The Amelia WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the l
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today