Critical SQL Injection Flaw Found in TMS Amelia Booking Plugin Versions Through 2.4.10

The National Vulnerability Database has recorded a critical security flaw in the TMS Amelia booking plugin, identified as CVE-2026-108497. This vulnerability allows for SQL injection attacks on websites using the software, posing a significant risk to data integrity and security.

According to the NVD record, the issue stems from improper neutralization of special elements used in SQL commands. The vulnerability is rated as critical with a Common Vulnerability Scoring System score of 9.3. This high severity rating indicates that the flaw is severe and could lead to serious consequences for affected systems if not addressed.

Context and Background

SQL injection remains one of the most dangerous web application vulnerabilities. It occurs when an attacker can insert malicious SQL statements into input fields for execution by the database. In this specific case, the TMS Amelia plugin involves improper neutralization of special elements in SQL commands.

The weakness is categorized under CWE-89, which refers specifically to SQL injection flaws. This classification helps security professionals understand the nature of the defect and apply appropriate mitigation strategies. The NVD entry provides clear technical details to assist in identifying and remediating the issue.

Who Is Affected

The vulnerability affects all versions of the TMS Amelia plugin from its initial release through version 2.4.10. Any website or application utilizing these versions is potentially exposed to SQL injection attacks. Administrators should verify their current plugin version immediately to determine if their systems fall within this affected range.

There is no indication in the source material that a patch or update has been released to fix this specific issue. Consequently, users of version 2.4.10 and earlier remain vulnerable until a vendor-provided solution becomes available. This lack of a confirmed fix heightens the urgency for administrators to assess their exposure.

What should you do?

Security teams should prioritize checking their installations of TMS Amelia against the affected version list. If a site is running version 2.4.10 or lower, it is considered at risk. Administrators should monitor vendor communications closely for any announcements regarding a security update or patch.

Until a fix is confirmed, organizations should consider implementing additional layers of defense. Web application firewalls can help detect and block common SQL injection patterns. Regular security audits and input validation checks can also reduce the likelihood of successful exploitation while waiting for an official remedy.