{"id":"CVE-2026-112327","kind":"vulnerability","aliases":["CVE-2026-112327"],"related":[],"title":"WordPress Amelia booking plugin: SQL injection lets visitors read database","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11.","summary":"The Amelia booking plugin for WordPress has an SQL injection flaw in versions up to 2.4.11. A remote attacker can run SQL against the site database, which can expose user accounts and other stored data.","severity":"critical","cvss":9.3,"epss":0.00241,"exploited":false,"exploited_at":null,"products":[{"name":"ameliabooking","fixed":["2.4.12"],"affected":"<= 2.4.11","ecosystem":"wordpress"}],"ecosystems":["wordpress"],"tags":["amelia","ameliabooking","package","self-hosted","sql-injection","unauthenticated","wordpress"],"not_affected_if":["plugin-not-installed","version-2.4.12-or-newer"],"how_to_check":"Check the installed Amelia (ameliabooking) plugin version in WordPress admin under Plugins; anything 2.4.11 or older is affected.","fix":"Update the ameliabooking plugin to 2.4.12 or later.","status":"open","published_at":"2026-10-22T09:17:14+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-23T22:32:33+00:00","updated_at":"2026-10-24T07:15:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:32:33Z","model":"claude-haiku-5-5","output":{"fix":"Update the ameliabooking plugin to 2.4.12 or later.","reach":"internet","title":"WordPress Amelia booking plugin: SQL injection lets visitors read database","impact":"high","summary":"The Amelia booking plugin for WordPress has an SQL injection flaw in versions up to 2.4.11. A remote attacker can run SQL against the site database, which can expose user accounts and other stored data.","category":"package","who_cares":["wordpress","ameliabooking","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker reads or changes the WordPress database, including admin credentials","analyst_note":"Sources do not say whether authentication is required or which endpoint is vulnerable; check the NVD entry and the vendor changelog for 2.4.12.","how_to_check":"Check the installed Amelia (ameliabooking) plugin version in WordPress admin under Plugins; anything 2.4.11 or older is affected.","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-2.4.12-or-newer"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000506,"input_tokens":2968,"output_tokens":418,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry and the vendor changelog for the fixed version and the vulnerable endpoint or whether authentication is required.","search":"'-112327':13A,16A '-2026':12A,15A '2.4.11':44B,90C 'account':59B 'affect':85C 'allow':81C 'amelia':2A,18B,30B,79C,86C 'ameliabook':19B,80C 'ameliabooking':17A 'attack':47B 'book':3A,31B 'command':73C 'cve':11A,14A 'data':63B 'databas':10A,54B 'element':68C 'expos':57B 'flaw':39B 'host':23B 'improp':64C 'inject':6A,26B,38B,75C 'injection.this':83C 'issu':84C 'let':7A 'n/a':88C 'neutral':65C 'packag':20B 'plugin':4A,32B 'read':9A 'remot':46B 'run':49B 'self':22B 'self-host':21B 'site':53B 'special':67C 'sql':5A,25B,37B,50B,72C,74C,82C 'sql-inject':24B 'store':62B 'tms':78C 'unauthent':27B 'use':69C 'user':58B 'version':41B 'visitor':8A 'vulner':76C 'wordpress':1A,28B,34B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T09:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112327","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112327","severity":null,"published_at":"2026-10-22T09:17:14+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112327:214","url":null,"severity":null,"published_at":"2026-10-23T22:24:06+00:00","modified_at":"2026-10-23T22:24:06+00:00","first_seen_at":"2026-10-23T22:24:06+00:00","fetched_at":"2026-10-23T22:24:06+00:00","note":"Patchstack (CVE assigner) and EUVD: Amelia <= 2.4.11 unauthenticated SQLi, CVSS 9.3, patched 2.4.12. Not in KEV, EPSS 0.24%, no public PoC found; vulnerable endpoint not disclosed. Did not search X. Sibling Amelia SQLi CVE-2026-108497 (<=2.4.10) was published a week earlier, so moving to 2.4.12 covers both."},{"source":"epss","external_id":"CVE-2026-112327","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112327","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1419,"url":"https://patchstack.com/database/wordpress/plugin/ameliabooking/vulnerability/wordpress-amelia-plugin-2-4-11-sql-injection-vulnerability","title":"Patchstack: Amelia <= 2.4.11 SQL Injection (patched 2.4.12)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1422,"url":"https://euvd.enisa.europa.eu/enisa/EUVD-2026-108054","title":"EUVD-2026-108054 (CVE-2026-112327)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1424,"url":"https://wordpress.org/plugins/ameliabooking/","title":"Amelia plugin page, WordPress.org","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}