Amelia Pro 4.0 Through 9.9.1 - Actively Exploited Unauthenticated SQL Injection (CVE-2026-116751)

Amelia Pro versions 4.0 through 9.9.1 are vulnerable to an unauthenticated SQL injection tracked as CVE-2026-116751. Patchstack lists the issue as actively exploited. Amelia Pro 9.9.2 contains the security fix, and the vendor recommends updating immediately.

Table of Contents

Vulnerability summary

Product: Booking for Appointments and Events Calendar – Amelia Pro
Affected versions: 4.0 through 9.9.1
Fixed version: 9.9.2
CVE: CVE-2026-116751
Attack class: Unauthenticated time-based SQL injection
Severity: Critical 9.3 according to Patchstack; High 7.5 according to Wordfence
Prerequisites: Amelia Pro is active and the vulnerable public event-filtering request path is reachable; no account or user interaction is required
Exploitation status: Patchstack marks the vulnerability as known exploited. This is Patchstack exploitation telemetry, not a CISA KEV designation.

Exploit path

Wordfence attributes the vulnerability to insufficient escaping and SQL preparation of array keys supplied through Amelia’s event tag filter. WordPress applies magic-quotes escaping to array values but not to array keys. Those attacker-controlled keys can reach EventRepository::getFilteredIds() and interfere with the plugin’s placeholder substitution, allowing additional SQL logic to be introduced into an existing query.

The reported impact is unauthenticated extraction of sensitive information from the WordPress database. This article intentionally omits exploit payloads and timing sequences.

Immediate remediation

Update Amelia Pro to version 9.9.2 or later through the vendor’s licensed update channel.
Purge page, object, and CDN caches after the update.
Verify the running Pro version directly; do not confuse the Amelia Lite version shown on WordPress.org with the affected commercial plugin version.
Review web and WAF logs for abnormal event-filter requests and database timing anomalies.
If the update cannot be applied immediately, deactivate Amelia Pro or temporarily restrict public Amelia event forms and API routes until the patched release is installed.

Verification and investigation

wp plugin list --fields=name,status,version,update,update_version
wp user list --fields=ID,user_login,user_email,user_registered --orderby=registered --order=DESC
wp core verify-checksums
wp db check

Confirm that the commercial Amelia Pro package reports version 9.9.2 or later. Because Pro updates can use a vendor license and a package directory different from Amelia Lite, identify the exact installed plugin entry before running any slug-specific update command.

Indicators of compromise

Repeated public event-filter requests containing deeply nested or malformed tag parameters.
Clusters of similar requests with progressively longer response times.
Unexpected SQL errors, database load spikes, or slow queries tied to Amelia event filtering.
Unknown administrator accounts, application passwords, scheduled tasks, or modified WordPress options.
Evidence that database contents were exported or accessed outside normal application behavior.

If exploitation is suspected, preserve logs before cleanup, rotate WordPress administrator and database credentials, revoke unknown sessions and application passwords, inspect modified files and cron events, and restore only from a verified clean backup.

Patch verification

Amelia’s official changelog lists version 9.9.2, released November 4, 2026, as an important security update and strongly recommends immediate installation. Wordfence and Patchstack both identify 9.9.2 as the patched version.

Amelia Pro 4.0 Through 9.9.1 – Actively Exploited Unauthenticated SQL Injection (CVE-2026-116751)