9.3
CriticalCVSS 3.1 · from Patchstack
CVE-2026-112327
WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability
ameliabooking · SQL injection · CWE-89Affectedameliabooking
FixUpdate to 2.4.12 or newer
PublishedOct 22, 07:01 · Patchstack
ScoredOct 22 · 9.3 · Patchstack
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can read data. CVSS impact.
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11.
From Patchstack
Affected and fixed versions
ProductAffectedFixed inameliabookingearlier versions2.4.12
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known