CVE-2026-4668 describes an SQL Injection vulnerability in the Amelia Booking plugin for WordPress affecting all versions up to 2.1.2. The issue is due to improper neutralization of special elements in the 'sort' parameter used in the payments listing endpoint. The parameter is directly inserted into an ORDER BY clause in the PaymentRepository.php file without sanitization or whitelist validation. PDO prepared statements do not protect column names in ORDER BY clauses, and GET requests bypass nonce validation, allowing authenticated users with 'wpamelia-manager' role or higher to append additional SQL queries. This can lead to extraction of sensitive data via time-based blind SQL injection.

An attacker with Manager-level or higher privileges can exploit this vulnerability to extract sensitive information from the database through time-based blind SQL injection. The vulnerability impacts confidentiality but does not affect data integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Manager-level access to trusted users only and monitor for suspicious activity related to the payments listing endpoint. Avoid exposing the vulnerable endpoint unnecessarily. Do not rely on PDO prepared statements alone for sanitizing ORDER BY parameters; whitelist validation is required.