Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-10-15T11:17:19.823Z",
  "pubdate": "2026-10-15T11:17:19.823Z",
  "executiveSummary": "The TMS Amelia booking plugin for WordPress, specifically versions ranging from n/a through 2.4.10, contains a critical vulnerability identified as Improper Neutralization of Special Elements used in an SQL Command, commonly referred to as SQL Injection (SQLi).\nThis vulnerability allows unauthenticated or authenticated attackers to manipulate database queries by injecting arbitrary SQL commands through vulnerable input parameters.\nThe impact of this flaw is severe, potentially leading to unauthorized disclosure, modification, or deletion of sensitive information stored within the WordPress database, including user credentials, booking data, and system configurations.\nSuccessful exploitation grants an attacker the ability to bypass application-level security controls, potentially leading to complete site compromise or remote code execution depending on the database configuration and underlying server privileges.\nOrganizations utilizing affected versions of the Amelia plugin face significant risk until the software is updated to a version that remediates the unsanitized input vectors.",
  "technicalDetails": "The vulnerability originates from the failure of the Amelia plugin to properly sanitize or parameterize user-supplied data before incorporating it into SQL queries executed against the WordPress database backend.\nIn a standard SQL Injection scenario within this context, the affected component fails to utilize prepared statements or parameterized queries, allowing an attacker to break out of the intended query structure using special characters such as single quotes ('), semicolons (;), or comment delimiters (-- or #).\nThe attack flow typically initiates with an attacker identifying an input field or URL parameter handled by the plugin that acts as a vector for database interaction. By supplying a crafted payload, the attacker influences the logic of the SQL statement, effectively appending or modifying the query's original intent.\nFor example, if the application executes a query such as \"SELECT * FROM amelia_appointments WHERE id = 'INPUT_PARAMETER'\", an attacker could provide an input like ' OR 1=1 --, altering the statement to \"SELECT * FROM amelia_appointments WHERE id = '' OR 1=1 --\". This forces the database to return all records regardless of the original filter criteria.\nBeyond data exfiltration, the exploit can be leveraged to conduct UNION-based attacks to retrieve data from other tables, or in scenarios where the database user has high privileges, perform stacked queries to execute administrative commands or modify existing application data.\nThis SQLi vulnerability is particularly dangerous as it operates at the database abstraction layer, rendering standard web application firewalls ineffective if they are not specifically configured to inspect and block malicious SQL patterns targeting this plugin.\nThe affected versions (n/a through 2.4.10) expose this attack surface to both authenticated and potentially unauthenticated users, depending on which specific endpoints within the plugin are vulnerable. Once the malicious payload is executed, the impact is limited only by the permissions of the database user account utilized by the WordPress installation, which often has wide-ranging access to the entire site schema."
}