---
id: "CVE-2026-116751"
page: "https://infrastack.ai/live/CVE-2026-116751"
kind: "vulnerability"
aliases: ["CVE-2026-116751"]
title: "Amelia Pro WordPress plugin: unauthenticated SQL injection exposes database contents"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "ameliabooking", "fixed": ["9.9.2"], "affected": ">= 4.0, <= 9.9.1", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["amelia-pro", "package", "self-hosted", "wordpress"]
not_affected_if: ["newer-version", "plugin-not-installed"]
published_at: "2026-11-07T12:17:43+00:00"
first_seen_at: "2026-11-07T12:47:08+00:00"
updated_at: "2026-11-07T12:51:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116751", "first_seen_at": "2026-11-07T12:47:08+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/amelia/amelia-pro-991-unauthenticated-sql-injection-via-tag-parameter-array-keys", "first_seen_at": "2026-11-07T12:51:06+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/amelia/amelia-pro-991-unauthenticated-sql-injection-via-tag-parameter-array-keys", "https://patchstack.com/database/wordpress/plugin/ameliabooking/vulnerability/wordpress-booking-for-appointments-and-events-calendar-amelia-pro-plugin-4-0-9-9-1-unauthenticated-sql-injection-vulnerability", "https://wpamelia.com/documentation/changelog/"]}]
exploit_sources: []
---

# Amelia Pro WordPress plugin: unauthenticated SQL injection exposes database contents

Link for people: https://infrastack.ai/live/CVE-2026-116751 (this .md is for agents)

The Amelia Pro booking plugin for WordPress passes a user-supplied tag array key into a database query without proper escaping, in versions up to and including 9.9.1. An unauthenticated attacker can append SQL to existing queries and extract sensitive data from the site's database.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:ameliabooking affected >= 4.0, <= 9.9.1 fixed 9.9.2

## How to check

- In WordPress admin under Plugins, check the Amelia / Amelia Pro version; 9.9.1 and earlier (Patchstack lists 4.0 through 9.9.1) are affected, 9.9.2 is the patched release.
- Confirm the plugin is active; an inactive plugin is not reachable.
- No public exploitation or PoC found as of this note.

## Fix

Update Amelia Pro to 9.9.2 or later (released 04.11.2026).

## Timeline

- 2026-11-07T12:47:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116751
- 2026-11-07T12:51:06+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/amelia/amelia-pro-991-unauthenticated-sql-injection-via-tag-parameter-array-keys — Wordfence advisory (researcher leon figueira, CVSS 7.5) and Patchstack name 9.9.2 as the patched version; the vendor changelog lists 9.9.2 (04.11.2026) as a security release but does not name this CVE, so fix is not marked verified. Patchstack rates it 9.3 and expects mass exploitation; none seen yet. X not checked.

## Documents

- [advisory] Wordfence: Amelia Pro <= 9.9.1 unauthenticated SQLi https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/amelia/amelia-pro-991-unauthenticated-sql-injection-via-tag-parameter-array-keys
- [advisory] Patchstack: Amelia 4.0-9.9.1 unauthenticated SQLi, patched 9.9.2 https://patchstack.com/database/wordpress/plugin/ameliabooking/vulnerability/wordpress-booking-for-appointments-and-events-calendar-amelia-pro-plugin-4-0-9-9-1-unauthenticated-sql-injection-vulnerability
- [fix] Amelia changelog (9.9.2, 04.11.2026) https://wpamelia.com/documentation/changelog/

## From the sources

The Booking for Appointments and Events Calendar – Amelia Pro plugin for WordPress is vulnerable to time-based SQL Injection via the 'tag[] (array KEYS)' parameter in all versions up to, and including, 9.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. WordPress's wp_magic_quotes escapes array values but not array keys, meaning attacker-controlled tag[] array keys reach EventRepository::getFilteredIds() completely unescaped and can be crafted to defeat the plugin's Statement::execute placeholder binder via overlapping strtr() substitution keys.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_