# CVE-2026-116751: Amelia Pro SQL injection in tag parameter

Source: https://junglewise.ai/threats/cve-2026-116751-the-booking-for-appointments-and-events-calendar-amelia-pro  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-07. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

CVE-2026-116751 · Severity: high · CVSS 7.5 · Published 2026-11-07

Amelia Pro is a WordPress plugin that manages bookings, appointments, and event calendars for small businesses. The plugin is vulnerable to SQL injection through the tag filter parameter, allowing attackers to read sensitive data from the website's database without needing to log in. This could expose customer information, payment details, and other confidential data.

Vendors: [Elfsight](https://junglewise.ai/threats/vendors/elfsight).

## Quick answers

**Is CVE-2026-116751 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116751 being exploited in the wild.

**How severe is CVE-2026-116751?** High severity, with a CVSS score of 7.5, published 7 November 2026.

**Which products and versions are affected?** Elfsight Amelia Pro up to and including 9.9.1.

**Is there a fix for CVE-2026-116751?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-116751 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116751?** Check whether you run Elfsight Amelia Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a time-based SQL injection in the EventRepository::getFilteredIds() function via the 'tag[]' array parameter. WordPress escapes array values but not array keys, allowing unauthenticated attackers to inject unescaped SQL through tag array keys that bypass the plugin's placeholder substitution mechanism. The attacker can craft overlapping strtr() substitution keys to defeat the Statement::execute placeholder binder and extract arbitrary database information.

## Affected products

- Elfsight Amelia Pro up to and including 9.9.1

## Timeline

- 2026-11-07: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/ameliabooking.php](https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/ameliabooking.php)
- [https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Application/Commands/Booking/Event/GetEventsCommandHandler.php](https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Application/Commands/Booking/Event/GetEventsCommandHandler.php)