Is CVE-2026-112327 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112327 being exploited in the wild.

How severe is CVE-2026-112327?

Critical severity, with a CVSS score of 9.3, published 22 October 2026.

Which products and versions are affected?

TMS Amelia booking plugin through 2.4.11.

How is CVE-2026-112327 attacked?

It is attacked over the network.

Am I affected by CVE-2026-112327?

Check whether you run TMS Amelia booking plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112327: TMS Amelia booking plugin SQL injection

CVE-2026-112327 · Severity: critical · CVSS 9.3 · Published 2026-10-22

Amelia is a WordPress booking and scheduling plugin used by many businesses to manage appointments and reservations. This SQL injection vulnerability allows unauthenticated attackers to directly manipulate or extract the entire database, including user accounts, customer data, and confidential information. An attacker could read sensitive booking information, modify reservations, delete data, or establish a foothold for further attacks.

Vendors: TMS.

Quick answers

Is CVE-2026-112327 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112327 being exploited in the wild.
How severe is CVE-2026-112327?: Critical severity, with a CVSS score of 9.3, published 22 October 2026.
Which products and versions are affected?: TMS Amelia booking plugin through 2.4.11.
Is there a fix for CVE-2026-112327?: Yes: fixed in 2.4.12 or later. Until then: Update to version 2.4.12 or later immediately. If unable to update, request your hosting provider or web developer apply the patch, or enable Web Application Firewall rules to block SQL injection attempts. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-112327 attacked?: It is attacked over the network.
Am I affected by CVE-2026-112327?: Check whether you run TMS Amelia booking plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.4.12 or later

Update to version 2.4.12 or later immediately. If unable to update, request your hosting provider or web developer apply the patch, or enable Web Application Firewall rules to block SQL injection attempts.

Technical details

SQL injection vulnerability in the Amelia WordPress plugin affecting versions through 2.4.11 allows unauthenticated attackers to inject arbitrary SQL commands. The vulnerability requires only network access with no authentication or user interaction needed. Successful exploitation permits complete database read, modification, and deletion capabilities.

Affected products

TMS Amelia booking plugin through 2.4.11

Timeline

2026-10-22: disclosed
2026-10-20: advisory: Patchstack published vulnerability details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.