The Amelia booking plugin for WordPress suffers from an SQL injection flaw that allows an attacker to inject arbitrary SQL through improperly sanitized user input. The vulnerability can enable the execution of malicious queries, potentially exposing, altering, or deleting database contents. The weakness is classified as CWE‑89, an injection vulnerability that directly threatens the confidentiality and integrity of the database.

All installations of the Amelia plugin version 2.4.11 or earlier are affected. The issue was discovered in the TMS Amelia ameliabooking plugin, which is commonly deployed on WordPress sites to manage appointments and bookings.

The CVSS score of 9.3 marks this as a critical flaw, and while the EPSS score is not available, the lack of a KEV listing does not diminish the high likelihood of exploitation in a web‑exposed environment. Attackers can exploit the flaw remotely via a crafted request to a publicly reachable endpoint, and once successful, they gain direct access to the database. The potential impact ranges from data theft to full database takeover, making immediate action essential.