Vulnerabilities / Booking for Appointments and Events Calendar – Amelia / WPSEC-2026-1507
Booking for Appointments and Events Calendar – Amelia <= 2.4.12 - Unauthenticated SQL Injection via Array Keys of Event Filter Parameters
High 7.5
CWE-89Fixed in 2.4.13
- ID
- WPSEC-2026-1507
- Plugin
- Booking for Appointments and Events Calendar – Amelia (ameliabooking)
- Affected
- all versions before 2.4.13
- Remediation
- Update to 2.4.13 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-89
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-23
- Attack surface
- Booking for Appointments and Events Calendar – Amelia on WPSec AttackSurface
- Fix released
- Published
Description
The Amelia plugin for WordPress is vulnerable to SQL Injection via the array keys of event filter parameters (such as 'providers', 'locations', 'customers' and 'events') in all versions up to, and including, 2.4.12. The plugin builds SQL placeholder names from attacker-controlled array keys, and its string-substitution binding routine does not validate placeholder names, so injected key text can end up as raw SQL. This makes it possible for unauthenticated attackers to append additional SQL queries to existing queries and extract sensitive information from the database.
References
- https://wpsec.com/vuln/WPSEC-2026-1507/
- https://plugins.svn.wordpress.org/ameliabooking/tags/2.4.13/
- https://wordpress.org/plugins/ameliabooking/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS