CVE-2026-4668

Published April 1st, 2026

View on NVD ↗

CVSS v3

6.5

MEDIUM

CVSS v2

N/A

Affected

PROJECT

Description

The Booking for Appointments and Events Calendar - Amelia plugin for WordPress is vulnerable to SQL Injection via the `sort` parameter in the payments listing endpoint in all versions up to, and including, 2.1.2. This is due to insufficient escaping on the user-supplied `sort` parameter and lack of sufficient preparation on the existing SQL query in `PaymentRepository.php`, where the sort field is interpolated directly into an ORDER BY clause without sanitization or whitelist validation. PDO prepared statements do not protect ORDER BY column names. GET requests also skip Amelia's nonce validation entirely. This makes it possible for authenticated attackers, with Manager-level (`wpamelia-manager`) access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via time-based blind SQL injection.

Booking for Appointments and Events Calendar – Amelia

Experience the most powerful booking system for appointments and event booking on WordPress! <a href="https://wpamelia.com/?utm_source=wp_org&utm_medium=wp_org&utm_content=link&utm_campaign=wp_org" rel="nofollow ugc">Amelia</a> (wpamelia) is a reliable booking calendar that automates online appointment scheduling and event booking processes. Our easy-to-use scheduling and event booking WordPress plugin has an intuitive design and provides you and your clients with an unparalleled booking experience. Amelia’s booking calendar presents services and events in a perfectly organized and easy-to-navigate manner, enabling your clients to find the most convenient time slots for their appointments or to reserve their spots for upcoming events. Amelia Lite WordPress Booking Plugin is an excellent solution for appointment-based businesses, individuals, and event management agencies. Our booking system guarantees a comfortable and user-friendly experience. In addition, the whole booking calendar is designed with a mobile-first approach, and both the admin and customers will experience a booking system that works perfectly across various devices. <iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/4iK5nnY9vTw?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe> A free appointment and event scheduling app gives your business the freedom to grow 📈 <ul> <li>No more no-shows with email and SMS reminders and follow-ups.</li> <li>Reach global customers with automatically detected time/zones and online meetings and events.</li> <li>Developers and website admins love Amelia’s WP admin panel easy to understand and uses clean, concise code with webhooks.</li> </ul> Amelia’s booking plugin features a new modern, smooth & fast appointment booking form optimized for conversion and ready in a minute. <h3>Who is the Amelia WordPress Booking Plugin For?</h3> Many businesses and individuals who depend on stable appointment booking, service booking, or event booking and scheduling on their WordPress websites can entirely rely on Amelia’s appointment and event booking system. <h3><a href="https://wpamelia.com/salon-booking-wordpress/?utm_source=wp_org&utm_medium=wp_org&utm_content=link&utm_campaign=wp_org" rel="nofollow ugc">Salon booking</a></h3> Features of our booking system salons love are automated reminders because their clients show up on time; payment integrations because they get paid on time; Google Calendar synchronization because it prevents double bookings; and more because running your salon has never been easier than with powerful booking system. <h3><a href="https://wpamelia.com/wordpress-booking-coaching/?utm_source=wp_org&utm_medium=wp_org&utm_content=link&utm_campaign=wp_org" rel="nofollow ugc">Consultants</a></h3> Features of our appointment booking system consultants love are recurring appointments because they always have time for regulars and it offers them financial stability; group appointments because they can help more people at once; and video conferencing tool integrations because they cater to clients all over the world. <h3><a href="https://wpamelia.com/wordpress-booking-medical/?utm_source=wp_org&utm_medium=wp_org&utm_content=link&utm_campaign=wp_org" rel="nofollow ugc">Healthcare booking</a></h3> Healthcare service providers love using our WordPress booking plugin, especially features like custom input fields, service packages and promotions, and custom schedules for doctors and nurses because they provide top-notch care to patients without worrying about management. <h3><a href="https://wpamelia.com/wordpress-booking-coaching/" rel="nofollow ugc">Education</a></h3> Education professionals especially love our scheduling features that allow them to show their availability calendar and book one-on-one and group classes without having to worry about administrative tasks. <h3><a href="https://wpamelia.com/wordpress-booking-gyms/?utm_source=wp_org&utm_medium=wp_org&utm_content=link&utm_campaign=wp_org" rel="nofollow ugc"> Fitness & Gyms </a></h3> Fitness specialists and gym staff love our WordPress booking plugin because clients can book 24/7, they can offer discount coupons with Amelia, and automate email and text notifications so clients always show up and get amazing results. <h3><a href="https://wpamelia.com/wordpress-booking-coaching/" rel="nofollow ugc">Coaching sessions</a></h3> Coaches enjoy the power of an easy-to-navigate booking system with features like virtual sessions, 24/7 booking, high-converting booking forms, secure online payments, and coupon codes that boost loyalty. <h3><a href="https://wpamelia.com/wordpress-booking-photography/" rel="nofollow ugc">Personal and Professional Services</a></h3> Professional service providers especially love scheduling and availability calendars because clients can book appointments 24/7 and they can focus on delivering high-quality services. <h3><a href="https://wpamelia.com/wordpress-event-plugin/?utm_source=wp_org&utm_medium=wp_org&utm_content=link&utm_campaign=wp_org" rel="nofollow ugc">Any Event type</a></h3> Event booking has never been easier than with our Event booking WordPress plugin because it’s rich in features like dynamic ticketing, deposit payments, and recurring events. ⚠️ Important note: Certain integrations, unlimited number of employees, custom notifications, reminders, multilingual support, different ticket options for events, and other features are not available in Amelia Lite. If you want to know more about Amelia premium versions, please visit our official <a href="https://wpamelia.com/?utm_source=wp_org&utm_medium=wp_org&utm_content=link&utm_campaign=wp_org" rel="nofollow ugc">Amelia Booking home page</a>. You can also try out Amelia before committing <a href="https://wpamelia.com/demos/?utm_source=wp_org&utm_medium=wp_org&utm_content=link&utm_campaign=wp_org" rel="nofollow ugc">Amelia Demo</a>. <h3>USEFUL LINKS 🔗</h3> <a href="https://wpamelia.com/?utm_source=wp_org&utm_medium=wp_org&utm_content=link&utm_campaign=wp_org" rel="nofollow ugc">Official Page</a> || <a href="https://wpamelia.com/demos/?utm_source=wp_org&utm_medium=wp_org&utm_content=link&utm_campaign=wp_org" rel="nofollow ugc">Amelia Demos</a> || <a href="https://wpamelia.com/documentation/?utm_source=wp_org&utm_medium=wp_org&utm_content=link&utm_campaign=wp_org" rel="nofollow ugc">Documentation</a> || <a href="https://www.youtube.com/c/AmeliaWordPressBookingPlugin" rel="nofollow ugc">Youtube</a> || <a href="https://www.instagram.com/wpamelia_plugin/" rel="nofollow ugc">Instagram</a> || <a href="https://twitter.com/wpameliabooking" rel="nofollow ugc">Twitter</a> || <a href="https://www.facebook.com/AmeliaBooking" rel="nofollow ugc">Facebook</a> || <a href="https://discord.com/invite/9xYWJqbXeM" rel="nofollow ugc">Discord Community</a> || <a href="https://wpamelia.com/pricing/?utm_source=wp_org&utm_medium=wp_org&utm_content=link&utm_campaign=wp_org" rel="nofollow ugc">Premium Versions</a> <h3>Amelia Lite Booking Plugin Features</h3> Amazing Deal Alert! We’ve partnered with SuperbThemes to bring you and your customers an unparalleled booking experience and more appointments than ever. As a result of this partnership, you get a FREE WordPress theme to use on your website integrated with Amelia’s booking system. You will literally get more online bookings than ever before, without any hassle as you get both the theme and the wpamelia booking system in all-in-one. Booking forms for online scheduling appointments and events management with a great user interface and user experience your customers will love. You can easily embed appointment booking forms with two shortcodes: – [ameliastepbooking] – [ameliacatalogbooking] By choosing one of them, you can choose whether you want to show the booking flow in a step-by-step view to your customers or you prefer the catalog view. With a catalog view, all services are presented in the form of cards. <ul> <li> No coding or design skills are required to embed Amelia booking shortcode into your website – <a href="https://wpamelia.com/documentation/step-by-step-booking-form/?utm_source=wp_org&utm_medium=wp_org&utm_content=link&utm_campaign=wp_org" rel="nofollow ugc">Amelia Booking shortcode</a> </li> <li> Easily embeddable event-booking form with the [ameliaeventslistbooking] shortcode, which allows you to show your events in the form of a list where all the most important information will be shown: Event date and time, location, capacity, status, price, etc. </li> <li> Accept online payments through Square. </li> <li> A convenient Calendar view on the back-end, giving a complete overview of all scheduled appointments end events – <a href="https://wpamelia.com/documentation/general-settings/?utm_source=wp_org&utm_medium=wp_org&utm_content=link&utm_campaign=wp_org" rel="nofollow ugc">Calendar Admin View</a> </li> <li> Configuration of your provider’s details and working schedule so you can choose in which time frames you want to be available for booking – <a href="https://wpamelia.com/general-settings/?utm_source=wp_org&utm_medium=wp_org&utm_content=link&utm_campaign=wp_org" rel="nofollow ugc">General Settings</a> </li> <li> Creation of services and categories in which those services will be organised – <a href="https://wpamelia.com/documentation/service-categories/?utm_source=wp_org&utm_medium=wp_org&utm_content=link&utm_campaign=wp_org" rel="nofollow ugc">Services and Service Categories</a> </li> <li> Creation of Events that can last one or multiple days – <a href="https://wpamelia.com/documentation/creating-events/?utm_source=wp_org&utm_medium=wp_org&utm_content=link&utm_campaign=wp_org" rel="nofollow ugc">Events</a> </li> <li> Tracking your booking business’ KPIs in the Dashboard like revenue, percentage of load, number of approved appointments and daily ocuppancy. You can also take a look at your next upcoming appointments easily – <a href="https://wpamelia.com/documentation/dashboard/?utm_source=wp_org&utm_medium=wp_org&utm_content=link&utm_campaign=wp_org" rel="nofollow ugc">Dashboard page</a> </li> <li> Customization of booking confirmation Email and SMS notifications for both customers and the provider – <a href="https://wpamelia.com/documentation/notifications-email/?utm_source=wp_org&utm_medium=wp_org&utm_content=link&utm_campaign=wp_org" rel="nofollow ugc">Email</a> and <a href="https://wpamelia.com/documentation/sms-notifications/?utm_source=wp_org&utm_medium=wp_org&utm_content=link&utm_campaign=wp_org" rel="nofollow ugc">SMS</a> notifications. </li> <li> Automatic prevention of double-booking. </li> <li> Picking a primary between 20+ languages. </li> <li> Setting the redirect URL on which the customers will be redirected after the booking. </li> <li> You can build your website pages with booking forms using Elementor, Divi, or Gutenberg blocks, and you can now choose between an on-page or pop-up booking form. </li> <li> Importing customers from a CSV file – <a href="https://wpamelia.com/documentation/importing-customers/?utm_source=wp_org&utm_medium=wp_org&utm_content=link&utm_campaign=wp_org" rel="nofollow ugc">Import Customers</a>. </li> <li> Showing booking slots on the Calendar in the client’s time zone. </li> <li> Easy customization of the booking form to fit your branding – <a href="https://wpamelia.com/documentation/customize/?utm_source=wp_org&utm_medium=wp_org&utm_content=link&utm_campaign=wp_org" rel="nofollow ugc">How to Customize</a> </li> </ul> <h3>ACCEPT ONLINE PAYMENTS FOR FREE</h3> We’re thrilled to announce an exciting new integration between Square and Amelia, that brings free payment processing to your fingertips! Now, even in the free version of Amelia, you can effortlessly accept payments for bookings and events using Square. Download Amelia Lite today, integrate it with Square, and forget about missed payments! What does Amelia Premium and Square integration mean for you? By integrating Amelia with Square, you can effortlessly accept online payments, providing clients with a secure and easy payment experience. Collect payments online, request deposit payments to reduce no-shows, offer refunds, and maintain full control over your bookings and payments at all times. This powerful integration improves your business operations, ensures smooth transactions, and improves client satisfaction. <h3>Premium Appointment and Event Booking Features</h3> <ul> <li> Custom Service Duration – Define a single Service with multiple durations your customers can choose from, define different prices for these durations, and define different prices for those durations per employee. </li> <li> Resources – Ability to create shared or single resources that limit the bookings, available only in Pro and Elite licenses. </li> <li> Address Custom Fields – Customers can enter their address which is linked to Google Maps, so it is easier to find the location where you will provide your service. </li> <li> Pay via a link – A great option for your customers to be able to pay after booking through a link, from mail, or Customer Panel. </li> <li> Email and SMS scheduled notifications – Different types of reminders and follow-ups with templates. </li> <li> Custom notifications – Create new templates, multiple reminders or follow-ups for appointments, schedule them at different times, or create a specific message for each service. </li> <li> Recurring appointments – Book multiple appointments for the same service that will repeat in a specific time increment. </li> <li> Custom Fields for the booking forms – Create different types of custom fields for the customer to enter during the booking process (special requests, their address, file upload or any question relevant to your business) </li> <li> Integrations – Zoom, Google Meet, Google Calendar, Outlook Calendar, Lesson Space, Facebook Pixel and Google Analytics. </li> <li> Accept online payments through PayPal, Stripe, WooCommerce, Mollie, and Razorpay. Online payments through Square are part of the AMELIA LITE and are FREE. </li> <li> Search the booking form for Appointments that give you the option to show the available appointments based on the search criteria 🔎 </li> <li> Event Calendar – Booking form that gives you the option to show upcoming events in a monthly calendar view. </li> <li> Manage multiple employees – Create the employees’ database, with specific working hours, service schedule, capacity, and price for each, as well as configure the days off and special days. </li> <li> Manage multiple locations – Suitable for businesses that offer their services in multiple locations. </li> <li> Multilingual support – Translate the names of services, categories, events, extras, notification templates, etc. into multiple languages that customers can choose on your website. </li> <li> More customization options to fully adjust your booking experience. Choosing colors, the order of the fields, and which fields will be mandatory. </li> <li> Custom options – Such as group booking, buffer times before and after the appointment, and extras. </li> <li> Customers panel and Employees panel – For tracking and managing appointments and events. </li> <li> Discount coupons – For bookings, creating and sending discount coupons to loyal customers. </li> <li> Packages of services – Creating the packages (bundles) of one or multiple services with a discount available to customers on the booking form. </li> <li> Event tickets – Create and offer different types of tickets for each event, with different prices. </li> <li> Set up the minimum or maximum number of attendees for each event . </li> <li> WebHooks– Connect Amelia with any other application using several different hooks and choosing which data you want to send. </li> <li> WhatsApp integration – Remind your customers or event attendees with WhatsApp reminders and follow-up messages. </li> <li> Show busy time slots – Display the availability of time slots, indicating how many slots are already booked. </li> <li> Refund option – Initiate a refund that will be processed through the online payment provider used to pay for the appointment/event. </li> <li> REST APIs management – Empowering developers to extend integrations and customize the booking process. </li> <li> Cart Feature – Streamline your booking process with seamless multiple appointments in a single transaction. </li> <li> Multiple Selections in Shortcode– Enhance flexibility by choosing from various options on a single webpage. </li> <li> No-show Customers Tag– Efficiently manage no-show customers on the backend with this tagging feature. </li> <li> Employee Badges– Elevate your booking experience by customizing badges for your employees. </li> <li> Hassle-Free Tax Management – Effortlessly handle and automate tax management for all your bookings and events. </li> </ul> <h3>5 easy steps to set up Amelia Lite Booking System</h3> <ol> <li> Go to your WordPress’ admin page, open Amelia -> Services, and add categories and services, as described <a href="https://wpamelia.com/documentation/service-categories/?utm_source=wp_org&utm_medium=wp_org&utm

WordPress Plugin Directory

1.44M