External risk intelligence

Amelia Booking SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-112327

The vulnerability exists in a WordPress booking plugin designed for public-facing functionality, such as scheduling appointments and customer interaction. These components are typically exposed directly to the internet to allow users to interact with the service, making them a common target for public network access.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical SQL injection vulnerability has been identified in the Amelia booking system, which could allow unauthorized access to or manipulation of sensitive data within the system. This type of flaw can be exploited remotely without requiring any user interaction, posing a significant risk if the affected system is publicly accessible.

Allows unauthorized database access.
Matters for protecting customer and booking data.
Confirm if Amelia booking system is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data over the network to the Amelia booking system. This malicious input would target a weakness in how the system handles user-provided information, potentially allowing the attacker to manipulate database commands. If successful, this could lead to unauthorized access to sensitive information within the database or disruption of the booking service.

No authentication required.
Vulnerable SQL query processing.
Sensitive data exposure or service disruption.

Live Threat

Current exploitation, exposure, and threat context

SQL injection in Amelia could allow an attacker to directly query or manipulate the plugin's database. This could potentially expose sensitive booking information or disrupt service operations.

Booking and customer data at risk.
Unauthenticated network access possible.
Service disruption or data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in Amelia booking software requires immediate attention from application owners and potentially platform teams responsible for the WordPress environment. The first step is to identify all instances of the affected plugin, determine their exposure to external networks, and assess their business criticality. Once ownership is confirmed, a remediation plan can be developed based on the identified risk.

Application owners must confirm ownership.
Verify plugin reachability and business criticality.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Amelia plugin for WordPress?

Amelia is a software extension used within WordPress websites to manage booking and scheduling. Businesses typically use this plugin to provide a public interface where customers can browse services, select appointments, and interact with the business calendar directly through the website.

How does this SQL injection vulnerability work?

This flaw belongs to the 'Improper Neutralization of Special Elements used in an SQL Command' class. In plain English, the plugin fails to properly clean data submitted by users before processing it. This allows an attacker to inject their own commands into the database query, potentially tricking the system into revealing or altering information it should keep private.

Do I need to be logged in to trigger this bug?

No, this vulnerability does not require authentication. An attacker can attempt to trigger the issue remotely by sending specifically formatted requests to the plugin over the network. Simply browsing or interacting with standard, non-malicious booking forms on your site does not trigger this vulnerability.

Is my site at risk if I use Amelia?

If your site uses an affected version of the Amelia plugin, you should be concerned. Halo Surface Signal notes that because this component is designed for public-facing scheduling, it is often directly exposed to the internet. This accessibility increases the likelihood that an attacker could reach the vulnerable code without needing special network permissions.

What steps should I take if I use this plugin?

Begin by inventorying your WordPress environments to confirm exactly where Amelia is installed. Once you have identified all instances, determine which sites are accessible from the internet and prioritize them based on the sensitivity of the data they handle. After confirming ownership and criticality, work with your team to prepare a remediation plan to address the software vulnerability.

References

patchstack.com/database/wordpress/plugin/ameliabooking/vulnerability…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.