CVE-2025-12482: Amelia WordPress Plugin SQLi Vulnerability

CVE-2025-12482 Overview

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress contains a SQL Injection vulnerability in the search parameter. This flaw exists in all versions up to and including 1.2.35 due to insufficient escaping of user-supplied input and inadequate preparation of SQL queries. Unauthenticated attackers can exploit this vulnerability to append malicious SQL queries to existing database queries, potentially extracting sensitive information from the WordPress database.

Critical Impact

Unauthenticated attackers can extract sensitive database information including user credentials, personal booking data, and potentially WordPress administrator credentials through SQL injection attacks.

Affected Products

• Amelia Booking for Appointments and Events Calendar WordPress Plugin versions ≤ 1.2.35

Discovery Timeline

• 2025-11-16 - CVE-2025-12482 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-12482

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) affects the EventRepository.php file within the Amelia WordPress plugin. The flaw stems from improper handling of user input in the search parameter, where the application fails to properly sanitize and escape user-supplied data before incorporating it into SQL queries.

The vulnerability allows unauthenticated remote attackers to manipulate database queries through the search functionality. Since no authentication is required, any visitor to a WordPress site running a vulnerable version of Amelia can potentially exploit this flaw. The attack is limited to data extraction (confidentiality impact) and does not allow modification or deletion of database records.

Root Cause

The root cause of this vulnerability is insufficient input validation and the lack of parameterized queries (prepared statements) in the EventRepository.php file. When user input from the search parameter is directly concatenated into SQL queries without proper escaping or the use of WordPress's built-in database preparation methods like $wpdb->prepare(), attackers can inject arbitrary SQL syntax to modify query behavior.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can craft malicious requests to the search functionality, injecting SQL syntax through the search parameter. This allows the attacker to:

1. Enumerate database tables and columns
2. Extract user data including emails, names, and booking information
3. Potentially access WordPress user credentials stored in the database
4. Retrieve plugin configuration data

The vulnerability exists in the event search functionality within the EventRepository.php file. Attackers can inject SQL payloads through the search parameter to manipulate query logic and exfiltrate data. For detailed technical analysis, refer to the WordPress Plugin Changeset showing the code changes in version 1.2.36.

Detection Methods for CVE-2025-12482

Indicators of Compromise

• Unusual or malformed search requests containing SQL syntax characters such as single quotes, UNION statements, or comment sequences
• Database error messages in web server logs related to malformed SQL queries
• Unexpected database query patterns showing attempts to access tables outside normal plugin operations
• High volume of search requests from single IP addresses targeting the Amelia booking functionality

Detection Strategies

• Monitor web application firewall (WAF) logs for SQL injection patterns targeting the Amelia plugin endpoints
• Implement database query logging and analyze for anomalous queries containing UNION, SELECT, or information_schema references
• Review WordPress access logs for suspicious patterns in search-related requests to Amelia plugin URLs
• Deploy intrusion detection rules that alert on common SQL injection payloads in HTTP parameters

Monitoring Recommendations

• Enable verbose logging for the WordPress database layer to capture query anomalies
• Configure web server access logs to capture full request URIs including query parameters
• Implement rate limiting on search functionality to detect and slow automated exploitation attempts
• Set up alerts for failed database queries that may indicate exploitation attempts

How to Mitigate CVE-2025-12482

Immediate Actions Required

• Update the Amelia Booking plugin to version 1.2.36 or later immediately
• Review database logs for signs of prior exploitation or data exfiltration
• Consider temporarily disabling the Amelia plugin if immediate update is not possible
• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns in the search parameter

Patch Information

The vulnerability has been addressed in Amelia plugin version 1.2.36. The fix involves proper input sanitization and the use of prepared statements for database queries. Site administrators should update through the WordPress plugin dashboard or by downloading the latest version from the WordPress plugin repository. For technical details on the code changes, see the WordPress Plugin Changeset. Additional vulnerability information is available in the Wordfence Vulnerability Advisory.

Workarounds

• Deploy a Web Application Firewall (WAF) with SQL injection protection rules enabled for the WordPress installation
• Implement server-level input filtering to sanitize the search parameter before it reaches the application
• Restrict access to the Amelia booking search functionality using .htaccess rules or server configuration until the patch is applied
• Consider using a WordPress security plugin that provides real-time SQL injection protection

# Example .htaccess rule to restrict access to vulnerable endpoint
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} search=.*['"\\;] [NC]
    RewriteRule ^.*$ - [F,L]
</IfModule>