PT-2025-47071 · WordPress · Amelia

Published 2025-11-16 · Updated 2025-11-21 · CVE-2025-12482

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Amelia plugin for WordPress versions up to and including 1.2.35

Description The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is susceptible to SQL Injection due to insufficient input validation and query preparation. Specifically, the search parameter is not adequately sanitized, allowing unauthenticated attackers to inject malicious SQL queries. Successful exploitation could lead to the extraction of sensitive information from the database. The vulnerable parameter is search.

Recommendations Update the Amelia plugin to a version later than 1.2.35.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-12482

Affected Products

Amelia

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-12482 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/cacf2e32-12cf-41a9-a57f-1135c165494c?source=cve · Note
• https://t.me/CVEtracker/37438 · Telegram Post
• https://twitter.com/cracbot/status/1991461582019391621 · Twitter Post
• https://twitter.com/RedPacketSec/status/1989934114426740872 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3390245/ameliabooking/tags/1.2.36/src/Infrastructure/Repository/Booking/Event/EventRepository.php · Note
• https://t.me/cveNotify/142935 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1989932127253569981 · Twitter Post
• https://twitter.com/CVEnew/status/1989916181596443104 · Twitter Post
• https://twitter.com/cracbot/status/1991823947583943010 · Twitter Post