CVE-2026-14782
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Amelia plugin for WordPress is vulnerable to SQL Injection during customer import. This affects all versions up to and including 2.4.3 due to insufficient input escaping and lack of query preparation.
Risk Assessment
An authenticated attacker with the wpamelia-manager role can inject additional SQL queries, potentially extracting sensitive information from the database, such as passwords or customer data.
Recommendation
Immediately update the Amelia plugin to the latest available version that includes a fix for this vulnerability.
Other vulnerabilities in Amelia
See all- CVE-2026-57702Critical
The Amelia WordPress plugin contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This affects versions up to and including 2.4.2.
- CVE-2026-6286High
The Amelia plugin for WordPress up to version 2.2 is vulnerable to Stored Cross-Site Scripting via customer name fields. An authentication bypass allows unauthenticated users to submit booking data, and in the admin calendar view, customer names are interpolated into JavaScript template literals and rendered via innerHTML without proper HTML entity encoding. An attacker can inject malicious scripts that execute when an administrator hovers over the appointment.
- CVE-2026-48889High
Amelia versions up to 2.3 contain a vulnerability that allows subscriber privilege escalation.
- CVE-2026-40795Medium
Amelia versions up to 2.2 contain a broken access control vulnerability that may allow unauthorized users to access subscriber resources.
- CVE-2026-40789High
Amelia versions up to 2.2 have a vulnerability that allows unauthorized access to sensitive data.
- CVE-2026-39487High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ameliabooking Amelia ameliabooking allows Blind SQL Injection. This issue affects Amelia: from n/a through <= 2.1.1.
Original NVD description (English source)
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the Customer Import in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with wpamelia-manager role, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.