TMS Amelia WordPress Plugin: Unauthenticated SQL injection
Summary
The Amelia booking plugin for WordPress contains an SQL injection flaw in versions up to and including 2.4.11. An unauthenticated remote attacker can send crafted requests to manipulate database queries. Successful exploitation could allow reading, modifying or deleting the entire database, including user accounts and customer data.
Affected
- Amelia WordPress plugin (slug ameliabooking) up to and including 2.4.11
- Vendor range per CNA: 0 to <= 2.4.11
Fixed in
- Update to version 2.4.12 or later (per Patchstack; not yet confirmed in an official TMS or WordPress.org changelog)
Workaround
- No vendor workaround known.
- Patchstack offers a mitigation rule for its customers until the plugin is updated.
- Interim option: a web application firewall or virtual patch in front of the site; no verified rule set for this CVE is known.
Exploitation
- Required privilege: none (unauthenticated).
- Known exploited (CISA KEV): not found at time of writing.
- Public proof of concept: none found; status unknown.
- Patchstack expects exploitation, but this is a prediction, not observed activity.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Inventory all WordPress sites with the ameliabooking plugin, including client sites.
- Update to 2.4.12 or later immediately and verify the installed version afterwards.
- Verify the 2.4.12 release on wordpress.org before rollout.
- If patching is delayed, disable the plugin and review the database and admin accounts for signs of tampering.
- Monitor web server logs for unusual requests to the plugin.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory for Amelia <= 2.4.11 patchstack.com
- Vulners CVE record CVE-2026-112327 vulners.com
- CVE Program record (cvelistV5 release) github.com
- WordPress.org plugin page Amelia wordpress.org
- Amelia changelog beta.wpamelia.com
- HOL Guard CVE-2026-112327 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:55.
Original description (NVD)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.