CVE-2026-112327: critical vulnerability in TMS Amelia
WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability
Published
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.3epss 0.2%
exploitation probability
0.2%top 86% of all CVEs
observed exploitation
nono source reports it
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Affected products
TMS · AmeliaRelated CVEs — TMS Amelia
In the same product, most dangerous first.
CVE-2026-48889HIGHWordPress Amelia plugin <= 2.3 - Privilege Escalation vulnerabilityEPSS 0.4%CVE-2026-40789HIGHWordPress Amelia plugin <= 2.2 - Sensitive Data Exposure vulnerabilityEPSS 0.4%CVE-2024-22298MEDIUMWordPress Amelia plugin <= 1.0.98 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-40795MEDIUMWordPress Amelia plugin <= 2.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-108497CRITICALWordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-96461HIGHWordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerabilityEPSS 0.2%