Amelia Booking Plugin EUVD-2026-76208

Exploitation requires an active WordPress account with the Editor role (or higher) on the target installation - unauthenticated exploitation is not possible per the PR:H CVSS metric. The target site must have the Amelia plugin installed and activated at version 2.4.9 or earlier. No other special configuration or non-default setting is indicated as a prerequisite. Exploitation is limited to: (1) possession of valid Editor credentials, (2) Amelia plugin being active on the WordPress instance, and (3) network access to the WordPress admin or front-end interface. Administrator accounts would trivially meet the privilege threshold. The I:N metric suggests write operations (UPDATE/INSERT/DROP) are not achievable via this injection path, limiting impact to data exfiltration.

The CVSS 7.6 score reflects a real but access-gated risk: PR:H (Editor role required) significantly limits the attacker pool to users with legitimate elevated access to the WordPress installation. EPSS data is absent from the provided intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. The S:C/C:H combination is the most serious signal - an Editor who successfully exploits this can read across the entire WordPress database, including user credential hashes and data from other plugins. Even a mid-sized municipal IT team in sopot maintaining a public-facing appointment booking system should treat this as urgent remediation rather than deferred patching, because Editor-level compromise (via phishing or credential reuse) becomes a full database read capability. The I:N (no integrity impact) in the CVSS vector suggests a read-only injection path rather than a stacked write/DDL injection - this narrows the blast radius but does not eliminate the risk of sensitive data exfiltration. No POC is publicly available per available intelligence, which modestly reduces near-term exploitation likelihood.

An attacker who has obtained Editor-level credentials - through phishing, credential stuffing against a reused password, or social engineering a site administrator - navigates to the Amelia booking management interface and submits a crafted SQL payload in an editable field. The unsanitized input reaches a dynamic query, allowing the attacker to enumerate WordPress database tables and extract user password hashes, PII from booking records, and potentially credentials for other installed plugins. No public POC exists at time of analysis, but the attack is straightforward once Editor access is obtained.