External risk intelligence

Amelia Booking SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-108497

Amelia is a WordPress booking plugin designed to be embedded on public-facing websites to handle client interactions, appointments, and service scheduling. Because it is intended for use by external visitors on a website, the vulnerable components are commonly exposed to the public internet by design.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Amelia booking plugin, which could allow unauthorized access to your database. This type of SQL injection flaw means that malicious actors might be able to manipulate or extract sensitive information stored within the booking system if it's exposed online. The main concern is to confirm if this plugin is in use and exposed externally.

A database access flaw exists.
Protects against unauthorized data access.
Confirm relevance and check exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data over the network to a vulnerable instance of the Amelia booking plugin. If the plugin does not properly sanitize user inputs before using them in database queries, an attacker could inject malicious SQL commands. This could allow the attacker to access or manipulate sensitive data within the application's database.

No authentication or privileges required.
Vulnerable input in the booking plugin.
Database compromise and unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

An SQL injection vulnerability in Amelia could allow an unauthenticated attacker to access or modify sensitive database information. This risk exists when the Amelia booking system is publicly accessible on a website.

Booking and user data
Via crafted SQL queries
Unauthorized data access or modification

Operational Fix

Recommended remediation, mitigation, and detection steps

SQL Injection vulnerabilities in the Amelia booking plugin require coordination between application owners, platform teams, and potentially vendor management. The first step is to identify all instances of the Amelia plugin, assess their exposure and criticality, and confirm the specific version in use. This will inform the remediation plan, which may involve vendor coordination for a fix or other risk mitigation strategies.

Application owners should prioritize this issue.
Verify plugin installation and network exposure.
Plan coordinated updates or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Amelia booking plugin?

Amelia is a WordPress plugin used to manage appointments and service scheduling. It acts as an automated assistant for businesses, allowing customers to book services directly through a website. Because it is designed to facilitate client interactions, it is typically embedded on public-facing pages where visitors provide information to secure bookings.

How does this SQL injection vulnerability work?

This flaw, classified as CWE-89, happens when software fails to properly filter special characters in user input before sending it to a database. Because the plugin does not neutralize these inputs, an attacker can insert their own database commands. This allows them to bypass normal application logic and potentially access or extract sensitive data stored in the database.

Do I need to be logged in for my site to be at risk?

No, this vulnerability does not require authentication or specific user privileges to trigger. An attacker can attempt to exploit this flaw simply by sending specially crafted data over the network to the plugin. If the input is processed by the vulnerable component, the malicious command can execute regardless of whether the attacker has an account on your site.

Why is this considered an external risk?

Halo Surface Signal identifies this as an external risk because the Amelia plugin is intended to be public-facing by design. Since it must communicate with internet users to function as a booking system, it is frequently reachable by anyone on the internet. This configuration makes it easier for an attacker to interact with the vulnerable entry point without needing access to your internal network.

When should I take action for CVE-2026-108497?

You should prioritize this immediately by confirming if your site uses the Amelia plugin and checking which version is currently active. Once you have identified your installations, assess whether they are exposed to the internet. This initial inventory is essential to inform your next steps, such as coordinating with your development team or the vendor for an update.

References

patchstack.com/database/wordpress/plugin/ameliabooking/vulnerability…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.