Amelia Pro, the WordPress Booking for Appointments and Events Calendar plugin, contains a time-based SQL injection flaw in the handling of the 'tag[]' parameter. The plugin fails to escape array keys, allowing an attacker to inject arbitrary SQL through crafted array keys. This vulnerability falls under CWE‑89 and can let an unauthenticated user extract sensitive database content or potentially execute arbitrary queries that may compromise application integrity.

All WordPress sites running Amelia Pro versions 9.9.1 and earlier are vulnerable. The flaw exists across the plugin’s event handling code and affects any site that uses the plugin without updating to a patched release.

The CVSS base score of 7.5 indicates a high‑severity condition. No EPSS value is currently available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation data. However, attackers can reach the vulnerable endpoint without authentication and can manipulate the 'tag[]' array keys via a crafted HTTP request, making remote exploitation straightforward if the site allows public access. The ease of injection combined with the potential for data exfiltration means the risk is significant for exposed or publicly accessible installations.