CVE-2026-4668: WordPress Amelia Plugin SQLi Vulnerability

CVE-2026-4668 Overview

The Booking for Appointments and Events Calendar - Amelia plugin for WordPress contains a SQL Injection vulnerability in the sort parameter of the payments listing endpoint. This vulnerability affects all versions up to and including 2.1.2 and allows authenticated attackers with Manager-level (wpamelia-manager) access or above to extract sensitive information from the database through time-based blind SQL injection attacks.

Critical Impact

Authenticated attackers can leverage this SQL Injection vulnerability to extract sensitive information from the WordPress database, potentially compromising user data, payment information, and other confidential records stored by the Amelia booking plugin.

Affected Products

• Booking for Appointments and Events Calendar - Amelia plugin for WordPress versions up to and including 2.1.2

Discovery Timeline

• 2026-04-01 - CVE-2026-4668 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-4668

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) exists due to insufficient input validation and sanitization in the payments listing functionality. The sort parameter is passed directly into an ORDER BY clause within the SQL query constructed in PaymentRepository.php without proper escaping or whitelist validation.

A critical aspect of this vulnerability is that PDO prepared statements, which the application uses for parameterized queries, do not provide protection for ORDER BY column names. This is because column identifiers in ORDER BY clauses cannot be parameterized in the same way as data values—they must be handled through explicit whitelisting or escaping.

Additionally, GET requests to the vulnerable endpoint bypass Amelia's nonce validation entirely, removing a layer of CSRF protection that would otherwise help mitigate exploitation.

Root Cause

The root cause lies in the improper handling of the user-supplied sort parameter in PaymentRepository.php. The sort field value is directly interpolated into the ORDER BY clause of the SQL query without any sanitization mechanism in place. The code lacks a whitelist of acceptable column names for sorting, and PDO prepared statements cannot protect against SQL injection in this context because ORDER BY identifiers are not bindable parameters.

Attack Vector

The attack is network-based and requires authentication with at least Manager-level (wpamelia-manager) privileges. An attacker can manipulate the sort parameter in GET requests to the payments listing endpoint to inject malicious SQL code. Because GET requests skip nonce validation, the attacker only needs valid session authentication to exploit this vulnerability.

The injection technique leverages time-based blind SQL injection, where the attacker infers database information based on response timing delays caused by conditional SQL statements (such as SLEEP() functions or heavy queries). This allows systematic extraction of sensitive database contents including usernames, password hashes, email addresses, and payment data.

The vulnerable code flow can be traced from the GetPaymentsCommandHandler.php to PaymentRepository.php where the unsanitized interpolation occurs.

Detection Methods for CVE-2026-4668

Indicators of Compromise

• Unusual GET requests to the Amelia payments listing endpoint (/wp-admin/admin-ajax.php?action=wpamelia_api&call=/payments) with suspicious sort parameter values
• Presence of SQL syntax in sort parameter including keywords like SLEEP, BENCHMARK, IF, or subquery patterns
• Abnormally slow response times on payment listing requests indicating time-based injection attempts
• Database query logs showing malformed ORDER BY clauses or suspicious SQL commands

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in the sort parameter of Amelia plugin requests
• Monitor WordPress admin-ajax requests for parameters containing SQL keywords or special characters like parentheses, quotes, or semicolons
• Analyze database slow query logs for queries originating from the Amelia plugin with unusual execution patterns
• Review access logs for repeated requests to payment endpoints with varying sort parameter values suggesting enumeration attempts

Monitoring Recommendations

• Enable verbose logging for WordPress admin-ajax.php requests and filter for Amelia-related calls
• Configure intrusion detection systems (IDS) to alert on time-based SQL injection signatures in HTTP traffic
• Monitor database connections from the WordPress application for unusual query patterns or extended execution times
• Set up alerts for multiple failed or suspicious requests from users with Manager-level Amelia permissions

How to Mitigate CVE-2026-4668

Immediate Actions Required

• Update the Amelia plugin immediately to a version beyond 2.1.2 that contains the security fix
• Review database access logs for any signs of exploitation prior to patching
• Audit accounts with wpamelia-manager role to ensure they are legitimate and necessary
• Consider temporarily disabling the Amelia plugin if an immediate update is not possible

Patch Information

The vulnerability has been addressed in the changeset 3488955 to the Amelia plugin repository. Site administrators should update to the latest version available through the WordPress plugin directory.

Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

• Restrict access to Manager-level (wpamelia-manager) roles to only trusted administrators until the patch is applied
• Implement WAF rules to block requests containing SQL injection patterns in the sort parameter
• Use a security plugin to add additional request validation for admin-ajax endpoints
• If feasible, temporarily disable the payments listing functionality in the Amelia plugin configuration

# Example: Restrict Amelia manager capabilities via wp-cli
wp user list --role=wpamelia-manager --format=table
# Review and remove unnecessary manager accounts
wp user remove-role <user_id> wpamelia-manager