CVE-2026-112327 TMS CVE debrief

Who should care

Administrators and users of the WordPress Amelia plugin, particularly those using versions up to 2.4.11, should be aware of this vulnerability and take necessary actions to update and secure their installations.

Why it matters

CVE-2026-112327 is a critical SQL injection vulnerability in the WordPress Amelia plugin versions up to 2.4.11. Administrators and users of the plugin should be aware of this vulnerability and take necessary actions to update and secure their installations.

• Potential data breaches due to malicious SQL injection
• Increased risk of security incidents and attacks
• Need for urgent patching and remediation efforts

Technical summary

The WordPress Amelia plugin versions up to 2.4.11 are vulnerable to a SQL injection attack. This vulnerability allows unauthenticated attackers to inject malicious SQL, potentially leading to data breaches and other security incidents. The vulnerability has been patched in version 2.4.12.

Defensive priority

High

Recommended defensive actions

• Update the Amelia plugin to version 2.4.12 or later
• Review and monitor database activity for suspicious queries
• Implement additional security measures to prevent SQL injection attacks

Evidence notes

The CVE record and source item provide details on the SQL injection vulnerability in the WordPress Amelia plugin. The vendor, TMS, has provided information on the affected versions and the patched version.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.