Executive Summary
A critical SQL injection vulnerability has been disclosed in Amelia, the appointment and event booking plugin for WordPress. Tracked as CVE-2026-112327 (CVSS 9.3), the flaw is an Improper Neutralization of Special Elements used in an SQL Command (CWE-89) and affects all versions through 2.4.11.
Patchstack assigned the CVE; it was reserved on 2026-10-19 and published on 2026-10-22. NVD analysis is pending.
Vulnerability Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-112327 |
| CVSS v3.1 | 9.3 (Critical), vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L |
| Weakness | CWE-89 — SQL Injection |
| Privileges / user interaction | None required |
| Affected versions | Amelia ≤ 2.4.11 |
| Fixed version | 2.4.12 or later |
The vector indicates the flaw is reachable over the network without authentication and can expose database contents beyond the plugin's own scope. The vulnerable endpoint and parameter have not been published in the sources reviewed.
A Second Amelia SQL Injection
This is not the first recent Amelia SQL injection. CVE-2026-108497 affected versions through 2.4.10 and was fixed in 2.4.11, which means 2.4.11 is still vulnerable to this newer issue. Sites that patched to 2.4.11 recently still need to update again.
Exploitation Status
No source reviewed marks CVE-2026-112327 as exploited in the wild, and it is not in CISA KEV at the time of writing. Unauthenticated SQL injection in a widely deployed booking plugin is a likely scanning target once technical details circulate.
Remediation
- Update Amelia to 2.4.12 or later on every site.
- Audit WordPress user accounts for unexpected administrators, and rotate credentials if you suspect exposure.
- Because booking systems hold customer names, emails and phone numbers, review database and web server logs for unusual queries against Amelia endpoints.
- Put a WAF rule set with SQL injection protection in front of sites that cannot patch immediately.