Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Amelia WordPress plugin can let attackers modify data

CVE-2026-108497 · published today
Summary

The Amelia booking plugin for WordPress, up to version 2.4.10, does not correctly filter user input. This allows a malicious user to run database commands that could view, change, or delete booking information. Update the plugin to the latest release or apply the vendor's security patch as soon as possible.

What to do
  • Update tms amelia to version 2.4.11.
Affected software
VendorProductAffected versions
tms amelia <= 2.4.10
Fix: upgrade to 2.4.11
Original advisory text
WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
9.3 Critical
Type
CWE-89SQL Injection
Timeline
Published15 Oct 2026
Updated15 Oct 2026
First seen15 Oct 2026
Sources
CVE-2026-108497 · NVD
CVE-2026-108497 · MITRE
Track software like this
Free during beta