CVE-2026-62112

Executive Summary

CVE-2026-62112 is a SQL injection (CWE-89) vulnerability affecting the Amelia WordPress booking plugin in versions up to and including 2.4.9. The flaw resides in the plugin's editor functionality and is exploitable by an authenticated user with elevated privileges (PR:H), enabling unauthorized database access. Successful exploitation can result in full confidentiality compromise of the underlying database, with a CVSS 3.1 base score of 7.6 (High) reflecting the scope change across trust boundaries.

Technical Analysis

The vulnerability is classified as an SQL injection (CWE-89) affecting the "Editor" component of the Amelia plugin for WordPress, in all versions up to and including 2.4.9. SQL injection arises when untrusted user input is concatenated directly into a database query without proper parameterization or escaping, allowing an attacker to alter the intended query semantics.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L provides the most reliable technical characterization available:

• AV:N (Network) — The vulnerability is reachable remotely over the network, consistent with a web-facing WordPress plugin endpoint.
• AC:L (Low Complexity) — No special conditions, race windows, or complex preconditions are required to trigger the injection.
• PR:H (High Privileges Required) — The attacker must already hold an authenticated account with elevated capabilities, such as an administrative or editor-level role. This significantly constrains the attack surface compared to an unauthenticated injection.
• UI:N (No User Interaction) — No victim must be tricked into clicking or visiting a page; the attacker drives the exploit directly.
• S:C (Scope Changed) — Exploitation can affect resources beyond the vulnerable component's security authority, indicating the injection can pivot from the plugin context into the underlying database layer.
• C:H / I:N / A:L — Confidentiality is fully impacted (complete read access to data returned by the injected query is plausible), integrity is not impacted, and availability suffers a low partial impact.

The "Editor" designation in the CNA title indicates the injection is reachable through an administrative/editor-facing interface within the plugin — for example, a management screen where an authorized user submits data that is subsequently used unescaped in a database query. Because the affected component is a WordPress plugin, the "editor" surface typically requires an authenticated session with a role that can access plugin administration functions, which aligns precisely with the PR:H rating.

Insufficient technical detail is available to name the specific vulnerable function, class, parameter, HTTP endpoint, or nonce-handling behavior. No CVE description provides function names, file paths, REST routes, or parameter identifiers, and none should be assumed. The vulnerability class — authenticated SQL injection through a plugin editor interface — is the defensible characterization.

Exploitation Scenarios

The following chain is a vulnerability-class reconstruction, not a claim of a specific public exploit. No public PoC, Nuclei template, or exploit code is available as of this writing.

1. Reconnaissance / target identification. An attacker enumerates WordPress sites running Amelia by fingerprinting plugin assets (e.g., requesting known plugin static paths or reading plugin metadata exposed in page source). Shodan dorks such as http.html:"ameliabooking" or http.html:"amelia-booking" can identify candidate hosts at scale. Affected versions must be determined via plugin version disclosure.

2. Authentication and privilege acquisition. Because PR:H is required, the attacker must obtain valid credentials for an account with editor-level or administrative access to the Amelia plugin interface. This could be reached through phishing, credential stuffing, purchase of leaked credentials, or prior compromise of a lower-privileged account later escalated. This precondition materially reduces the likelihood of opportunistic mass exploitation but does not eliminate risk on multi-tenant or agency-managed WordPress installs where many users hold elevated roles.

3. Triggering the injection. Once authenticated, the attacker interacts with the plugin's editor functionality, supplying crafted input that is incorporated into a backend SQL statement without parameterization. Because AC:L applies, the injection triggers deterministically — no timing or concurrency tricks are needed. The point of injection is a data field processed by the editor component; the exact field name is not disclosed in the available intelligence.

4. Payload execution and post-exploitation impact. Classic SQL injection payload classes apply — boolean-based, error-based, union-based, or time-based inference — depending on how query results are reflected. Per the CVSS vector, the realistic outcome is confidentiality compromise (C:H) across a changed scope (S:C): the attacker can extract database contents such as user tables, hashed WordPress credentials, and plugin-specific data (customer records, appointment data, payment-adjacent metadata). The low availability impact (A:L) suggests query disruption or resource exhaustion side effects are possible but not the primary objective. Integrity is not rated as impacted, so direct data tampering is not the modeled outcome, though credential extraction can enable follow-on account takeover and privilege escalation outside the initial injection.

Impact Assessment

• Confidentiality (High): Full exposure of data returned by the exploited query surface — a serious risk for any site storing customer PII, appointment records, or authentication data in the WordPress database.
• Integrity (None per CVSS): The model does not assume direct modification; however, extracted credentials may facilitate downstream integrity breaches indirectly.
• Availability (Low): Partial, non-catastrophic availability impact.
• Scope (Changed): The vulnerability's effects cross a security boundary, elevating the overall severity to 7.6 (High) despite equal-or-lower base characteristics.
• Blast radius: Every WordPress installation running Amelia ≤ 2.4.9 with one or more accounts holding editor/administrative access. Managed hosting, agencies with shared admin pools, and multi-author sites concentrate risk.

Exposure: Sites are only exploitable by an authenticated high-privilege user, so unauthenticated internet-wide exploitation is not indicated. Risk is elevated in environments with weak account hygiene, shared credentials, or stale privileged accounts.

Detection Guidance

Sigma Rule

title: Amelia Plugin Editor SQL Injection Attempt (CVE-2026-62112)
id: 8b3f1c62-9d47-4a10-9c2e-amelia62112
status: experimental
description: Detects SQL injection payload patterns targeting Amelia WordPress plugin editor endpoints (versions <= 2.4.9)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-62112
author: valtersit.com
date: 2026/01/01
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.62112
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-query|contains:
      - 'amelia'
  selection_sqli:
    cs-uri-query|contains:
      - 'UNION SELECT'
      - 'union+select'
      - 'SLEEP('
      - 'BENCHMARK('
      - "' OR '1'='1"
      - 'information_schema'
      - 'CONCAT('
      - '--+'
  condition: selection_uri and selection_sqli
falsepositives:
  - Legitimate administrative queries
  - Security scanner probing
level: high

YARA Rule

rule CVE_2026_62112_Amelia_SQLi
{
    meta:
        description = "Detects SQL injection payloads targeting Amelia plugin editor (CVE-2026-62112)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-62112"
        date = "2026-01-01"
        severity = "high"
    strings:
        $s1 = "UNION SELECT" ascii nocase
        $s2 = "information_schema" ascii nocase
        $s3 = "BENCHMARK(" ascii nocase
        $s4 = "SLEEP(" ascii nocase
        $s5 = "' OR '1'='1" ascii
        $s6 = "amelia" ascii nocase
        $s7 = "/wp-content/plugins/ameliabooking" ascii nocase
    condition:
        uint16(0) == 0x3C3F or
        (any of ($s1,$s2,$s3,$s4,$s5) and any of ($s6,$s7)) or
        filesize < 512KB and 2 of ($s1,$s2,$s3,$s4,$s5)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-62112 Amelia Plugin SQL Injection Attempt"; flow:established,to_server; http.uri; content:"amelia"; nocase; http.uri; pcre:"/(UNION[\s\+]+SELECT|information_schema|BENCHMARK\s*\(|SLEEP\s*\()/i"; http.method; content:"GET"; http.method; content:"POST"; classtype:web-application-attack; reference:cve,2026-62112; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-62112; sid:202662112; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [network where network.protocol == "http" and url.path : "*amelia*"]
  [network where network.protocol == "http" and url.query : ("*UNION SELECT*" or "*information_schema*" or "*SLEEP(*" or "*BENCHMARK(*" or "*' OR '1'='1*")]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri_lower = lower(uri)
| eval query_lower = lower(cs_uri_query)
| where match(uri_lower, "amelia") AND (
    match(query_lower, "union\+select") OR
    match(query_lower, "information_schema") OR
    match(query_lower, "sleep\(") OR
    match(query_lower, "benchmark\(") OR
    match(query_lower, "%27\s+or\s+%271%27%3D%271")
  )
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as target_uris by src_ip
| where count > 2
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,ameliabooking,">
  <rule id="20266211" level="10">
    <if_sid>31100</if_sid>
    <id>^/</id>
    <url>amelia</url>
    <regex type="pcre2">(?i)(union[\s\+]+select|information_schema|benchmark\s*\(|sleep\s*\(|' or '1'='1)</regex>
    <description>CVE-2026-62112: Possible Amelia plugin SQL injection attempt detected in HTTP request.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sql_injection,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, fixed version, or workaround has been published. Treat all Amelia installations ≤ 2.4.9 as vulnerable.

1) Immediate mitigations

• Restrict access to the Amelia editor/administrative interfaces to trusted IP ranges via WAF or server-level ACLs.
• Review and minimize accounts with editor-level or higher privileges; revoke stale or shared credentials and enforce least privilege.
• Enforce strong authentication (unique passwords, MFA) for all WordPress administrative users, since exploitation requires authenticated access.
• Deploy the provided detection rules and enable SQL injection signature sets on WAF/IDS.
• Consider temporarily disabling or restricting the Amelia plugin if the business function permits and risk is unacceptable.

2) Patch / upgrade steps

• Monitor the Amelia vendor site and the WordPress plugin repository for a security release exceeding 2.4.9.
• Upon release, test in staging and upgrade immediately; verify the plugin version in production.
• Track CVE-2026-62112 in NVD and any future CNA/WordPress advisories for updated fixed-version information.

3) Long-term hardening

• Maintain an inventory of all WordPress plugins with version and CVE tracking; subscribe to vulnerability feeds.
• Enforce a rapid plugin update cadence and remove unused plugins.
• Apply database least-privilege principles to the WordPress DB user.
• Log and monitor administrative activity within WordPress and retain web server logs for retrospective SQLi hunting.

References

• NVD — CVE-2026-62112: https://nvd.nist.gov/vuln/detail/CVE-2026-62112
• MITRE CWE-89 — SQL Injection: https://cwe.mitre.org/data/definitions/89.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (score not yet available for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-62112 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / in-the-wild note: No public PoC, exploit code, or Nuclei template is available, and this CVE is not listed in CISA KEV. No active exploitation campaigns are known at this time. No EPSS score has been assigned by FIRST.org. All exploitation details above are inferred strictly from the vulnerability class (CWE-89) and the published CVSS vector; specific endpoint, parameter, and code-level specifics are not disclosed in available intelligence.