External risk intelligence

Amelia Booking Blind SQL Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-57702

The vulnerability affects a WordPress booking plugin designed to provide public-facing web functionality. Such plugins are typically deployed to enable customer-facing appointment scheduling and reservation interfaces on websites, making them reachable via the internet by design.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Amelia booking plugin, which allows for SQL injection attacks. This type of attack can potentially compromise the integrity of data within the affected system. The main concern at this time is to confirm if this plugin is in use and assess any potential exposure.

Allows attackers to inject malicious database commands.
Affects systems using the Amelia booking plugin.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted input to a web application that uses the affected booking plugin. This input could manipulate database queries, leading to unauthorized access to sensitive information or unintended actions within the application. The attacker does not need any special privileges or user interaction to trigger this flaw.

Accessible via the network.
Malicious input to the application.
Data leakage and unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

This SQL injection vulnerability in the Amelia booking plugin could allow an unauthenticated attacker to perform blind SQL injection attacks. When supported by the advisory, this could enable an attacker to infer information about the underlying database structure and potentially sensitive data through crafted requests, without direct access to the database content.

Sensitive database information could be exposed.
Via specially crafted network requests.
Attackers may infer database structure.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership for this SQL injection vulnerability likely falls to the application owners and platform teams responsible for the Melograno Venture Studio Amelia booking system. The immediate first step is to identify all instances of the affected Amelia booking system, confirm their accessibility and business criticality, and then engage the accountable owner to plan a risk-based remediation strategy.

Application owners must be identified.
Verify system reachability and criticality.
Plan remediation based on exposure risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Amelia booking plugin?

Amelia is a WordPress plugin developed by Melograno Venture Studio. It is commonly used by businesses to add automated appointment scheduling, event booking, and reservation management features directly onto their websites.

What does SQL injection mean for CVE-2026-57702?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. In plain terms, it means the plugin fails to properly filter user-supplied data, allowing an attacker to inject their own commands into the website's database queries to access or manipulate data.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by sending specially crafted web requests to the application. Because this is a blind SQL injection, the attacker does not need legitimate user credentials or special privileges to initiate the attack; simply sending malicious input that the plugin processes is sufficient to begin attempting to extract information.

Is my instance of Amelia vulnerable?

According to Halo Surface Signal, this plugin is designed to provide public-facing scheduling interfaces, which makes it inherently reachable over the internet. If your website uses an affected version of the Amelia plugin, it is likely exposed to remote attackers since the service is intended to be accessible to the public.

What should I do if I use the Amelia plugin?

Your first step is to perform an inventory of your environment to locate all active instances of the Amelia booking plugin. Once identified, evaluate the business criticality of those specific sites and coordinate with your technical team to prioritize and apply the necessary security updates provided by the vendor.

References

patchstack.com/database/Wordpress/Plugin/ameliabooking/vulnerability…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.