Critical SQL Injection Flaw Found in TMS Amelia Booking Plugin

The National Vulnerability Database has recorded a critical security flaw in the TMS Amelia booking plugin. This vulnerability, identified as CVE-2026-112327, allows for SQL injection attacks against websites using the software.

The issue stems from improper neutralization of special elements used in SQL commands. According to the NVD record, this weakness enables attackers to manipulate database queries. The flaw is present in TMS Amelia versions ranging from the initial release through version 2.4.11.

Context and Background

The Common Vulnerabilities and Exposures identifier for this issue is CVE-2026-112327. The National Vulnerability Database assigns it a CVSS score of 9.3, which places it in the Critical severity range. This high score reflects the potential impact of the vulnerability on affected systems.

The weakness is categorized under CWE-89, which covers SQL injection flaws. This type of vulnerability occurs when an application includes unsafe data in a database query. Attackers can exploit this to execute arbitrary code or access sensitive information stored in the database.

Who Is Affected

Any website running TMS Amelia is potentially vulnerable to this attack. The NVD record specifies that the issue affects Amelia from its earliest versions through 2.4.11. Users who have not updated their software beyond this version are at risk.

TMS Amelia is a popular booking and scheduling plugin often used on WordPress sites. The widespread use of such plugins means many organizations may be exposed. Administrators need to verify their current version to determine if they are impacted by this specific flaw.

What should you do?

Security teams should immediately audit their environments for the presence of TMS Amelia. Identifying the specific version installed is the first step in assessing risk. If the version is 2.4.11 or lower, the system is vulnerable to SQL injection.

While no patch has been confirmed in the source material, users should monitor vendor communications closely. Implementing strict input validation can help mitigate SQL injection risks temporarily. Keeping all software components up to date is a standard security practice that helps reduce exposure to known vulnerabilities.