AMELIABOOKING · CVE-2026-116751 · Package
FIX → 9.9.2
The Amelia Pro booking plugin for WordPress passes a user-supplied tag array key into a database query without proper escaping, in versions up to and including 9.9.1. An unauthenticated attacker can append SQL to existing queries and extract sensitive data from the site's database.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any WordPress site running the Amelia booking plugin (Amelia Pro) at version 9.9.1 or earlier is exposed, since unauthenticated requests with a crafted tag[] array key reach the database query. Sites without the plugin, or on 9.9.2 or later, can skip it.
Not affected if newer-version, plugin-not-installed
Who cares amelia-pro, self-hosted, wordpress
Upgrade to 9.9.2
Update Amelia Pro to 9.9.2 or later (released 04.11.2026).
The Booking for Appointments and Events Calendar – Amelia Pro plugin for WordPress is vulnerable to time-based SQL Injection via the 'tag[] (array KEYS)' parameter in all versions up to, and including, 9.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. WordPress's wp_magic_quotes escapes array values but not array keys, meaning attacker-controlled tag[] array keys reach EventRepository::getFilteredIds() completely unescaped and can be crafted to defeat the plugin's Statement::execute placeholder binder via overlapping strtr() substitution keys.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.