---
id: "CVE-2026-112327"
kind: "vulnerability"
aliases: ["CVE-2026-112327"]
title: "WordPress Amelia booking plugin: SQL injection lets visitors read database"
severity: "critical"
cvss: 9.3
epss: 0.00241
exploited: false
status: "open"
category: "package"
products: [{"name": "ameliabooking", "fixed": ["2.4.12"], "affected": "<= 2.4.11", "ecosystem": "wordpress"}]
ecosystems: ["wordpress"]
tags: ["amelia", "ameliabooking", "package", "self-hosted", "sql-injection", "unauthenticated", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-2.4.12-or-newer"]
published_at: "2026-10-22T09:17:14+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-24T07:15:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112327", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:24:06+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112327", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# WordPress Amelia booking plugin: SQL injection lets visitors read database

The Amelia booking plugin for WordPress has an SQL injection flaw in versions up to 2.4.11. A remote attacker can run SQL against the site database, which can expose user accounts and other stored data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:ameliabooking affected <= 2.4.11 fixed 2.4.12

## How to check

Check the installed Amelia (ameliabooking) plugin version in WordPress admin under Plugins; anything 2.4.11 or older is affected.

## Fix

Update the ameliabooking plugin to 2.4.12 or later.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112327
- 2026-10-23T22:24:06+00:00 analyst — Patchstack (CVE assigner) and EUVD: Amelia <= 2.4.11 unauthenticated SQLi, CVSS 9.3, patched 2.4.12. Not in KEV, EPSS 0.24%, no public PoC found; vulnerable endpoint not disclosed. Did not search X. Sibling Amelia SQLi CVE-2026-108497 (<=2.4.10) was published a week earlier, so moving to 2.4.12 covers both.
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112327

## Documents

- [advisory] Patchstack: Amelia <= 2.4.11 SQL Injection (patched 2.4.12) https://patchstack.com/database/wordpress/plugin/ameliabooking/vulnerability/wordpress-amelia-plugin-2-4-11-sql-injection-vulnerability
- [describes] EUVD-2026-108054 (CVE-2026-112327) https://euvd.enisa.europa.eu/enisa/EUVD-2026-108054
- [fix] Amelia plugin page, WordPress.org https://wordpress.org/plugins/ameliabooking/

## From the sources

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_