Percival AI
Small business owner with a WordPress site? Two critical flaws this week can reach it, and your site could be hit by either one or both. One is in the Amelia booking plugin, covered here. The other is in PHP, the software WordPress itself runs on, which we covered in our Oct. 21 post on the PHP2Shell flaw. Fixing one does not fix the other.
- Amelia booking plugin, version 2.4.11 or older: update it to 2.4.12. The steps are below.
- PHP on your web server (PHP2Shell): ask your web host to confirm PHP is on a fixed version. Here’s what to ask them.
A critical Amelia plugin flaw was published Oct. 22, 2026, and it affects WordPress websites that run Amelia version 2.4.11 or older. It lets an attacker reach the site’s database without logging in. A fixed version, 2.4.12, is out. Neither source we read says attackers are using the flaw yet.
If your business website runs WordPress and takes appointments or bookings, this one is worth five minutes today. If your site isn’t built on WordPress, or doesn’t use Amelia, you can relax. Most home users can skip it too.
Patchstack, the security company that reported the flaw, says bugs like this are expected to be picked up quickly. So we’d rather you check now than after something goes wrong.
The facts on the Amelia plugin flaw
The flaw is tracked as CVE-2026-112327. A CVE is just a public ID number so everyone can talk about the same bug. Amelia is a plugin, a add-on program for WordPress that adds booking features to a website.
| Product | Affected | Fixed |
|---|---|---|
| Amelia (WordPress plugin) | 2.4.11 and earlier | 2.4.12 |
The record was published Oct. 22 and rated 9.3 out of 10 for severity, which is “critical.” Patchstack’s database entry says a researcher reported it Oct. 18 and that Patchstack published its entry Oct. 20. The CVE listing on cvefeed.io says it can be attacked over the internet, and that the attacker needs no account and no help from a user.
Patchstack says this kind of bug is “expected to become exploited.” That is a warning, not a report of attacks. We’d treat it as a clock that is already ticking.
What the Amelia plugin flaw lets attackers do
The bug is called SQL injection. In plain words, a website keeps its information in a database, like a big filing cabinet. SQL is the language the site uses to ask the cabinet for things. With this flaw, an attacker can sneak their own instructions into those requests.
Patchstack says that can let an attacker read, change or delete the entire database. That includes user accounts and private data.
For a small business, that could mean your customer records, appointment details and website logins. It could also mean bookings wiped out. None of that needs the attacker to log in first.
Why small sites get hit too
You might think nobody would bother with a small local website. Patchstack says otherwise. It says attackers use flaws like this in mass campaigns that hit thousands of websites at a time, no matter how much traffic a site gets or how popular it is.
Attackers don’t pick targets by name. They scan the internet for any site running the weak version. A salon, a dog groomer or a small clinic in Puyallup or Bonney Lake looks the same to them as anyone else.
That’s why the site’s age or size doesn’t protect it. The version number of one plugin is what counts.
How to check if you’re affected
You don’t need to be technical for this part. Here is what we’d do:
- Log in to your WordPress dashboard, the admin area of your website.
- Click Plugins, then Installed Plugins.
- Look for Amelia in the list.
- Read the version number under its name.
If there’s no Amelia, you’re not affected by this one. If the version is 2.4.11 or lower, update it. Both Patchstack and the CVE listing say to move to 2.4.12 or later.
Not sure who set up your site? Your web developer or hosting company can check. Patchstack itself says to ask them for help if you can’t update on your own.
We’ve covered a similar situation before. In PHP2Shell Flaw: Update PHP on Your Website Now, the website software itself needed a patch. Website problems often come down to something that’s simply out of date.
What to do this week
- Check for Amelia. Open your WordPress dashboard and look at the plugin list. It takes about two minutes.
- Update to 2.4.12 or later. If your version is 2.4.11 or older, run the update. Make a backup of your site first if you can.
- Ask for help if you’re stuck. Call your web developer or host. Tell them the CVE number: CVE-2026-112327.
- Look for anything odd. Check for admin users you don’t recognize, new pages you didn’t make, or missing bookings. If something looks wrong, change your admin passwords and get help.
- Check your other plugins. While you’re logged in, update anything else that shows an available update. Delete plugins you no longer use.
If your site has been up for a while and nobody has been watching it, that’s a common gap. Updates get skipped because everyone is busy. It’s an easy thing to fix once someone owns it.
Where this leaves you
Nothing here needs panic. It needs a quick look and, if you run Amelia, an update. If you’d like a second pair of eyes on your website, email, computers and backups, we offer a free 30-minute assessment. There is no cost and no contract, and we can do it remotely or on-site. You can also read about how we help with security.
Sources
- Patchstack vulnerability database entry for Amelia 2.4.11 (Patchstack)
- CVE-2026-112327 record (cvefeed.io, listing the CVE record from Patchstack)
This article was drafted by Percival, Rainier IT’s AI writing assistant, from the sources linked above, and reviewed by Christopher Engelhardt before publication. Spot an error? Email [email protected].
Protected by reCAPTCHA. Google's Privacy Policy and Terms apply.