CVE-2026-112327: WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability

Q: Which installations are affected?

The issue affects TMS Amelia's Amelia WordPress plugin through version 2.4.11. The available information does not identify a lower affected version bound.

Q: Does exploitation require authentication or user interaction?

No. The supplied vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What impact could successful exploitation have?

The supplied severity vector indicates high confidentiality impact and low availability impact. It indicates no integrity impact.

Published Oct 22, 2026

Updated

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11.

Affected Software

1 affected component

TMS Amelia Amelia<=2.4.11

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Amelia plugin to a version that resolves this vulnerability.
Fixed in 2.4.12

Event History

Oct 22, 2026

CVE Published

via MITRE·07:01 AM

Data Sourced

via MITRE·07:01 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

The issue affects TMS Amelia's Amelia WordPress plugin through version 2.4.11. The available information does not identify a lower affected version bound.

Does exploitation require authentication or user interaction?