# Booking for Appointments and Events Calendar – Amelia <= 2.4.12 - Unauthenticated SQL Injection via Array Keys of Event Filter Parameters

- **ID:** WPSEC-2026-1507
- **Plugin:** Booking for Appointments and Events Calendar – Amelia (`ameliabooking`), https://wordpress.org/plugins/ameliabooking/
- **Affected versions:** all versions before 2.4.13
- **Fixed in:** 2.4.13 (Update to 2.4.13 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-89
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ameliabooking
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1507/

## Description

The Amelia plugin for WordPress is vulnerable to SQL Injection via the array keys of event filter parameters (such as 'providers', 'locations', 'customers' and 'events') in all versions up to, and including, 2.4.12. The plugin builds SQL placeholder names from attacker-controlled array keys, and its string-substitution binding routine does not validate placeholder names, so injected key text can end up as raw SQL. This makes it possible for unauthenticated attackers to append additional SQL queries to existing queries and extract sensitive information from the database.

## References

- https://wpsec.com/vuln/WPSEC-2026-1507/
- https://plugins.svn.wordpress.org/ameliabooking/tags/2.4.13/
- https://wordpress.org/plugins/ameliabooking/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1507/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.