The Amelia WordPress plugin version 1.2.35 and earlier contain a SQL Injection flaw in the search parameter because the input is not properly escaped or bound in the existing query. An unauthenticated attacker can inject arbitrary SQL code, allowing extraction of confidential information from the database. This vulnerability is identified as CWE‑89, reflecting that the underlying misuse of an SQL parser can be exploited without authentication.

WordPress sites running the Amelia Booking for Appointments and Events Calendar plugin up to and including version 1.2.35 are vulnerable. Sites using the updated 1.2.36 release are not affected as the fix was applied to the EventRepository logic.

The CVSS score of 7.5 represents a high‑severity risk; however the EPSS probability of exploitation is less than 1%, indicating a low likelihood of widespread attacks at present. The vulnerability is not listed in the CISA KEV catalog, which suggests it has not yet been observed in known exploits. Attackers would need to craft a web request targeting the search endpoint, exploit the injection point, and read data, requiring no privileges on the host server.