Amelia WordPress Plugin SQL Injection Vulnerability in Customer Import Feature

A SQL injection vulnerability has been identified in the Booking for Appointments and Events Calendar – Amelia plugin for WordPress, affecting all versions up to and including 2.4.3. The issue arises in the Customer Import feature, where insufficient escaping of user-supplied parameters and inadequate preparation of the SQL query allow authenticated attackers with the wpamelia-manager role to inject additional SQL queries. This exploitation could lead to unauthorized access to sensitive information in the database.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling authenticated attackers to manipulate SQL queries and potentially extract sensitive database information.