# Booking for Appointments and Events Calendar – Amelia <= 2.4.12 - Unauthenticated Sensitive Information Exposure via Error Messages

- **ID:** WPSEC-2026-1509
- **Plugin:** Booking for Appointments and Events Calendar – Amelia (`ameliabooking`), https://wordpress.org/plugins/ameliabooking/
- **Affected versions:** all versions before 2.4.13
- **Fixed in:** 2.4.13 (Update to 2.4.13 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-209
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ameliabooking
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1509/

## Description

The Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.12 due to the plugin returning raw internal exception and database error messages in API responses. This makes it possible for unauthenticated attackers to obtain internal details such as database error text, which can aid in further attacks like SQL injection.

## References

- https://wpsec.com/vuln/WPSEC-2026-1509/
- https://plugins.svn.wordpress.org/ameliabooking/tags/2.4.13/
- https://wordpress.org/plugins/ameliabooking/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1509/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.