Security notice
Take bookings with Amelia Pro on WordPress? Someone without a login can try to read your site's database. Update to 9.9.2 or later today.
Amelia Pro, the premium booking plugin for WordPress, has CVE-2026-116751 in versions 9.9.1 and earlier. It is an unauthenticated SQL injection: someone without a login can send crafted requests that try to read information out of your site's database, which can hold customer details and user accounts. Patchstack marks it as known to be exploited. Update to 9.9.2 or later today. If you cannot update, deactivate the plugin until you can. (Patchstack, NVD)
What happened
- The flaw. CVE-2026-116751 affects the Amelia Pro booking plugin for WordPress through 9.9.1. A weakness in how the plugin handles a tag filter lets an attacker without a login add their own database commands to a request. NVD describes it as a time-based SQL injection that can be used to extract sensitive information from the database. (Patchstack, NVD)
- What an attacker gets. Information from the site's database, which can include customer details, bookings and user accounts. Patchstack describes this class of flaw as one where attackers can read, modify or delete the entire database. (Patchstack, NVD)
- The fix. Patchstack lists 9.9.2 as the patched version. Amelia Pro is a premium plugin, so the update comes through your plugin license. (Patchstack)
- Severity. Patchstack rates it CVSS 9.3, high priority, requires no login, and marks it as known to be exploited. NVD lists a Wordfence score of 7.5 (high). (Patchstack, NVD)
Who should worry
Any WordPress site running Amelia Pro 9.9.1 or earlier, especially sites that store customer names, emails and booking history. This notice covers the premium Amelia Pro plugin; Patchstack's listing is for versions 4.0 through 9.9.1.
What to do now
- Update Amelia Pro to 9.9.2 or later today. Back up the site and database first, then update. (Patchstack)
- If the update has to wait, deactivate the plugin until you can install the fixed version. This pauses online booking, so tell customers how to book in the meantime.
- Check for signs of tampering. Look for unexpected new admin or customer accounts, changed passwords, odd orders or form entries, and strange database activity. Updating closes the flaw; it does not undo access an attacker may already have gained.
- If you find signs of a break-in, change passwords, tell affected customers, and ask your developer or host to investigate.
What to send your developer, agency or host
Please check whether our WordPress site runs the Amelia Pro booking plugin. CVE-2026-116751 affects Amelia Pro versions 4.0 through 9.9.1; it is an unauthenticated SQL injection that can expose database contents, fixed in 9.9.2. Please update today, or deactivate until the update can be installed, then check for unexpected accounts or database activity and confirm the version you left us on. Sources: Patchstack, NVD.
Common questions
Does this mean my site was hacked?
No. A vulnerable version is a reason to update and review the site, not proof of a break-in. Patchstack marks this flaw as known to be exploited, so do not wait.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We cannot see which WordPress plugins your site runs or which versions they are on. A scan without a warning about this plugin does not mean your site is safe.
Where can I follow updates?
Follow Patchstack, the NVD entry and the Amelia site. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Patchstack: CVE-2026-116751, affected Amelia Pro versions 4.0 through 9.9.1, patched in 9.9.2, CVSS 9.3, published November 6, 2026.
- NVD: CVE-2026-116751 record.
- the Amelia site.