CVE-2026-108497: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in TMS Amelia

The vulnerability identified as CVE-2026-108497 affects the TMS Amelia booking plugin (ameliabooking) and is classified as an SQL Injection issue. It arises from improper neutralization of special elements used in SQL commands, enabling attackers to inject arbitrary SQL code. The affected versions include all releases from the initial version up to 2.4.10 inclusive. The CVSS 3.1 base score is 9.3, with attack vector network, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact.

An attacker can exploit this vulnerability remotely without authentication or user interaction to execute arbitrary SQL commands on the backend database. This can lead to full disclosure of sensitive data (confidentiality impact) and partial disruption of service (availability impact). The integrity of data is not impacted according to the CVSS vector. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's announcements for updates. Until a fix is available, consider restricting access to the affected application and applying web application firewall (WAF) rules to detect and block SQL injection attempts if feasible.