[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOMJug_bzrfi6cMy7QNk7v78sv3Ow5nqaBi4pOm4N03s":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":9,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":40},"CVE-2026-57702","booking-for-appointments-and-events-calendar-amelia-unauthenticated-sql-injection","Booking for Appointments and Events Calendar – Amelia \u003C= 2.4.2 - Unauthenticated SQL Injection","The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","ameliabooking",null,"\u003C=2.4.2","2.4.3","high",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","2026-07-08 00:00:00","2026-07-14 19:38:12",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fca155a52-4ee8-45dd-a74c-7155ea5bc0c1?source=api-prod",7,[22,23,24,25,26,27,28,29],"ameliabooking.php","docs\u002Fprovider-mobile-auth.md","languages\u002Far\u002Fameliabooking-ar.po","languages\u002Fca\u002Fameliabooking-ca.po","languages\u002Fcs_CZ\u002Fameliabooking-cs_CZ.po","languages\u002Fda_DK\u002Fameliabooking-da_DK.po","languages\u002Fde_AT\u002Fameliabooking-de_AT.po","languages\u002Fde_CH\u002Fameliabooking-de_CH.po","researched",false,3,"I cannot fulfill your request. I am prohibited from generating actionable plans, payloads, or specific instructions for the exploitation of software vulnerabilities, including SQL injection. My purpose is to be helpful and harmless, and providing such information could facilitate unauthorized access to systems or data.\n\nIf you are interested in software security, I encourage you to explore defensive security practices and secure coding principles. You can find comprehensive resources on these topics through organizations like:\n\n*   **OWASP (Open Web Application Security Project):** Provides extensive guides on preventing SQL injection and other web vulnerabilities.\n*   **WordPress Developer Documentation:** Offers specific guidance on [securing plugins](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F), including the proper use of `$wpdb->prepare()` and data sanitization.\n*   **NIST (National Institute of Standards and Technology):** Provides frameworks and standards for maintaining robust cybersecurity postures.\n\nFor security researchers, focusing on responsible disclosure and remediation is a critical part of the ecosystem. I recommend reviewing the [WordPress Vulnerability Disclosure Policy](https:\u002F\u002Fmake.wordpress.org\u002Fcore\u002Fhandbook\u002Ftesting\u002Freporting-security-vulnerabilities\u002F) if you have discovered a security issue in a plugin.","The Amelia plugin for WordPress (versions up to and including 2.4.2) contains an unauthenticated SQL injection vulnerability due to insufficient input sanitization and the lack of proper SQL preparation. An attacker can exploit this by sending specially crafted requests to the plugin's API endpoints, allowing for the extraction of sensitive database information through malicious SQL commands.","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fameliabooking\u002F2.4.2\u002Fameliabooking.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fameliabooking\u002F2.4.3\u002Fameliabooking.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fameliabooking\u002F2.4.2\u002Fameliabooking.php\t2026-06-18 11:33:16.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fameliabooking\u002F2.4.3\u002Fameliabooking.php\t2026-06-30 07:36:22.000000000 +0000\n@@ -3,7 +3,7 @@\n Plugin Name: Amelia\n Plugin URI: https:\u002F\u002Fwpamelia.com\u002F\n Description: Amelia is a simple yet powerful automated booking specialist, working 24\u002F7 to make sure your customers can make appointments and events even while you sleep!\n-Version: 2.4.2\n+Version: 2.4.3\n Author: Melograno Ventures\n Author URI: https:\u002F\u002Fmelograno.io\u002F\n Text Domain: ameliabooking\n@@ -118,7 +118,7 @@\n \n \u002F\u002F Const for Amelia version\n if (!defined('AMELIA_VERSION')) {\n-    define('AMELIA_VERSION', '2.4.2');\n+    define('AMELIA_VERSION', '2.4.3');\n }\n \n \u002F\u002F Const for site URL\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fameliabooking\u002F2.4.2\u002Fdocs\u002Fprovider-mobile-auth.md \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fameliabooking\u002F2.4.3\u002Fdocs\u002Fprovider-mobile-auth.md\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fameliabooking\u002F2.4.2\u002Fdocs\u002Fprovider-mobile-auth.md\t2026-06-18 11:33:16.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fameliabooking\u002F2.4.3\u002Fdocs\u002Fprovider-mobile-auth.md\t2026-06-30 07:36:22.000000000 +0000\n@@ -245,7 +245,7 @@\n \n - **Plugin:** `tests\u002Fphpunit\u002FApplication\u002FCommands\u002FLoginNonceExemptionTest.php` locks the\n   nonce exemption that lets the mobile app log in without a nonce\u002FAPI key. Runs in CI via\n-  the existing `phpunit` step in `bitbucket-pipelines.yml`.\n+  the existing `PHPUnit` job in `.github\u002Fworkflows\u002Fci.yml`.","The exploit targets the plugin's custom API handler accessible via the WordPress AJAX endpoint. \n\n1. **Endpoint Identification**: The attacker identifies an unauthenticated API endpoint used by the front-end booking interface, such as `\u002Fwp-admin\u002Fadmin-ajax.php?action=wpamelia_api&call=\u002Fappointments` or `\u002Fevents`.\n2. **Parameter Manipulation**: User-supplied query parameters like `search`, `page`, or filter arrays (e.g., `services` or `categories`) are targeted. These parameters are historically processed in repository classes (like `AppointmentRepository`) where they might be concatenated directly into SQL strings without being passed through `$wpdb->prepare()`.\n3. **Payload Construction**: An attacker crafts a payload using SQL syntax (e.g., `') UNION SELECT ... --`) to break out of the intended query logic and join data from the `wp_users` table or other database structures.\n4. **Data Extraction**: Using either direct output (if the API returns the results of the modified query) or blind techniques (boolean-based or time-based), the attacker exfiltrates database contents such as administrator usernames, password hashes, or site configuration details.\n5. **Authentication**: No authentication or specific user role is required to trigger the vulnerable code paths.","gemini-3-flash-preview","2026-07-16 14:34:03","2026-07-16 14:35:03",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","2.4.2","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fameliabooking\u002Ftags\u002F2.4.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fameliabooking.2.4.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fameliabooking\u002Ftags\u002F2.4.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fameliabooking.2.4.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fameliabooking\u002Ftags"]