Booking Sites Urged to Update TMS Amelia Plugin Amid Critical SQL Injection Vulnerability

Organisations using the TMS Amelia booking system face a severe risk of database manipulation due to a newly disclosed security flaw. The vulnerability allows attackers to inject malicious code into SQL commands, potentially compromising sensitive data stored within the plugin’s database. This issue has been assigned the identifier CVE-2026-108497 and is rated as Critical by security researchers.

The flaw exists in the way the plugin processes special characters within SQL commands. According to the National Vulnerability Database, this improper neutralisation affects all versions of TMS Amelia up to 2.4.10. With a CVSS score of 9.3, the potential impact is significant, enabling remote attackers to execute arbitrary SQL statements. No patch has been confirmed yet for this specific issue.

What we know

The vulnerability is classified as CWE-89, which refers to Improper Neutralisation of Special Elements used in an SQL Command. This means the software fails to correctly handle user input that contains special characters, allowing attackers to alter the intended SQL query. The TMS Amelia plugin, widely used for appointment booking, is affected in all versions released up to 2.4.10.

Security analysts have highlighted the severity of this exposure, noting that SQL injection remains one of the most dangerous web application vulnerabilities. The high CVSS score reflects the ease with which an attacker could exploit this flaw to access, modify, or delete database records. Users of the plugin should assume their systems are vulnerable until a fix is available.

Defender's checklist

• Audit all WordPress installations to identify if TMS Amelia is installed.
• Check the current version of the plugin against the affected range up to 2.4.10.
• Monitor database logs for unusual SQL queries or unexpected data changes.
• Prepare an incident response plan in case of suspected exploitation.

The background in plain language

SQL injection occurs when an application allows user input to interfere with database queries. Imagine a form where you enter your name; if the system does not check for malicious characters, an attacker could enter code that tricks the database into revealing hidden data. Teams usually mitigate this by validating all inputs and using parameterised queries. Check whether your web applications properly sanitise user data before it reaches the database layer.

Background: SQL injection

SQL injection occurs when untrusted data is inserted into a database query without proper sanitisation. The attacker manipulates input fields to alter the query structure, tricking the database into executing unintended commands. This process bypasses application logic, granting direct access to underlying data stores.

Read the full guide: How SQL Injection Works: The Step-by-Step Attack Lifecycle

What to do and how to stay safe: TMS Amelia

• Verify if your website uses the TMS Amelia plugin and note its current version.
• Restrict access to administrative panels and monitor for suspicious login attempts.
• Once the vendor provides an update, apply it immediately to all affected sites.
• Review database permissions to limit the damage potential of any successful injection.

Step-by-step guide: Virtual Patching: Benefits, Limits and When to Use It

General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-108497?

The vulnerability has a CVSS score of 9.3, which is rated as Critical.

Which versions of TMS Amelia are affected by this flaw?

All versions of the TMS Amelia plugin up to and including 2.4.10 are affected.

Is there a patch available for this SQL injection vulnerability?

No fix has been confirmed yet according to the available source material.