The Amelia booking plugin for WordPress is vulnerable to SQL injection through the Customer Import feature in all releases up to 2.4.3. The flaw stems from insufficient escaping and lack of parameterization of user supplied data, enabling an authenticated user with the wpamelia‑manager role to inject additional SQL statements. This can be used to read sensitive information from the database, compromising confidentiality but not necessarily integrity or availability. The weakness is a classic input validation failure (CWE‑89).

WordPress sites running the Booking for Appointments and Events Calendar – Amelia plugin version 2.4.3 or earlier are affected. Any installation that has the wpamelia‑manager role enabled can exploit the vulnerability; the plugin itself does not enforce role restrictions beyond the authentication requirement.

The CVSS score of 4.9 indicates moderate risk, and the EPSS score is below 1%, suggesting a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers need legitimate credentials with the wpamelia‑manager role and must trigger the Customer Import function to insert malicious SQL. Since the flaw is local and authenticated, external direct attacks are not feasible without first compromising user accounts.