CVE-2026-108497: WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Amelia pluginto a version that resolves this vulnerability.Fixed in 2.4.11
Event History
Frequently Asked Questions
Which Amelia installations are affected?
The issue affects TMS Amelia versions through 2.4.10. The available data does not identify a lower affected version boundary.
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the likely security impact?
The CVSS vector indicates high confidentiality impact, no integrity impact, and low availability impact. It also indicates scope may be changed.