9.3
CriticalCVSS 3.1 · from Patchstack
CVE-2026-108497
WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability
ameliabooking · SQL injection · CWE-89Affectedameliabooking
FixUpdate to 2.4.11 or newer
PublishedOct 15, 11:00 · Patchstack
ScoredOct 15 · 9.3 · Patchstack
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC
What we know
No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can read data. CVSS impact.
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10.
From Patchstack
Affected and fixed versions
ProductAffectedFixed inameliabookingearlier versions2.4.11
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known