CVE-2026-4668: 
WordPress vulnerability analysis and mitigation

CVE-2026-4668 is a SQL Injection vulnerability in the Booking for Appointments and Events Calendar – Amelia plugin for WordPress, affecting all versions up to and including 2.1.2. The flaw resides in the payments listing endpoint, where the user-supplied sort parameter is interpolated directly into an ORDER BY clause without sanitization or whitelist validation. It was published on April 1, 2026, with a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Wordfence).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). In PaymentRepository.php (around line 623), the sort field from user input is concatenated directly into an ORDER BY clause of an existing SQL query without sanitization or whitelist validation — a pattern that PDO prepared statements cannot protect against, since they do not parameterize column or clause names. Additionally, GET requests to the payments listing endpoint bypass Amelia's nonce validation entirely, removing a layer of CSRF-style protection. The vulnerable code path is also visible in GetPaymentsCommandHandler.php (line 59), which passes the unsanitized parameter downstream (GitHub Advisory, PaymentRepository source).

Successful exploitation allows authenticated attackers with Manager-level (wpamelia-manager) access or higher to perform time-based blind SQL injection, enabling extraction of sensitive information from the WordPress database — including user credentials, personal data, booking records, and payment details. The impact is limited to confidentiality (no integrity or availability impact), but database exposure can facilitate account takeover or further attacks if credential hashes are recovered (GitHub Advisory, Wordfence).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The vulnerability requires authenticated access at the Manager level or above, which limits the attack surface compared to unauthenticated flaws. The EPSS score is approximately 0.01% (3rd percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify WordPress sites running the Amelia booking plugin (version ≤ 2.1.2) via HTTP response headers, plugin enumeration tools (e.g., WPScan), or public search engines.
2. Obtain Manager credentials: Acquire a wpamelia-manager (or higher) account through phishing, credential stuffing, or social engineering, as the vulnerability requires authenticated access.
3. Locate the payments listing endpoint: Navigate to or directly craft a GET request to the Amelia payments listing REST endpoint (e.g., /wp-admin/admin-ajax.php or the relevant REST route for payment listings).
4. Inject malicious sort parameter: Append a time-based blind SQL injection payload to the sort parameter, such as sort=id,(SELECT SLEEP(5)), exploiting the lack of sanitization in the ORDER BY clause. Since GET requests bypass nonce validation, no CSRF token is needed.
5. Extract data via time-based inference: Use tools like sqlmap with time-based blind technique (--technique=T) against the vulnerable endpoint to enumerate database tables, extract password hashes, user emails, or other sensitive records (GitHub Advisory, PaymentRepository source).

• Network: Repeated GET requests to the Amelia payments listing endpoint with unusual or encoded sort parameter values (e.g., containing SQL keywords like SLEEP, BENCHMARK, IF, SELECT, or parentheses).
• Logs: WordPress access logs showing GET requests to the payments endpoint with sort parameters containing SQL syntax; abnormal response time patterns (e.g., consistent 5-second delays) indicative of time-based blind injection.
• Database: Unexpected or high-volume query activity originating from the Amelia payments query path; slow query logs showing ORDER BY clauses with injected SQL fragments.
• Application: Amelia plugin logs or WordPress debug logs showing SQL errors or unusual query structures from PaymentRepository.php.

Update the Amelia plugin to a version newer than 2.1.2, which includes the patch that sanitizes the sort parameter before interpolation into the ORDER BY clause (plugin changeset). As interim mitigations: restrict Manager-level (wpamelia-manager) access to only fully trusted users; deploy a Web Application Firewall (WAF) with rules to detect and block SQL injection patterns in query parameters; and monitor database slow query logs for anomalous activity from the payments endpoint (GitHub Advisory, Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the advisory and assigned the CVE (Wordfence). No significant broader media coverage or notable researcher commentary beyond the initial advisory has been identified at this time.