Now officially on WordPress.org

CVE Database / CVE-2026-14782

CVE · Medium

CVE-2026-14782 — Booking for Appointments and Events Calendar – Amelia [ameliabooking] < 2.4.4

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-14782 Booking for Appointments and Events Calendar – Amelia [ameliabooking] < 2.4.4 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Medium 4.9 < 2.4.4 2.4.4 2026-07-16 —

CVE-2026-14782

The Amelia plugin for WordPress contains a security flaw in its customer import feature, affecting versions up to and including 2.4.3. This vulnerability allows attackers with the wpamelia-manager role to inject malicious SQL code into existing queries, potentially revealing sensitive database information. The issue stems from inadequate protection against user-supplied input and insufficient preparation of the underlying SQL query.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings