CVE-2026-12937: Tourfic WordPress Plugin SQLi Vulnerability

CVE-2026-12937 Overview

CVE-2026-12937 is a SQL Injection vulnerability [CWE-89] in the Tourfic AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin. All versions up to and including 2.22.7 are affected. The flaw exists in the handling of the post_id parameter, which is concatenated into a SQL query without sufficient escaping or preparation. The AJAX handler wp_ajax_nopriv_tf_room_availability is registered for unauthenticated users, and the required nonce is emitted on the public single-hotel page template. Unauthenticated attackers can retrieve a valid nonce from any public hotel page and reach the vulnerable code path to extract sensitive database content.

Critical Impact
Unauthenticated attackers can append arbitrary SQL queries to existing statements and exfiltrate sensitive information from the WordPress database.

Affected Products

Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin versions through 2.22.7
WordPress sites exposing the single-hotel page template publicly
Any site with the wp_ajax_nopriv_tf_room_availability AJAX handler enabled

Discovery Timeline

2026-06-25 - CVE-2026-12937 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-12937

Vulnerability Analysis

The vulnerability resides in the room availability lookup logic of the Tourfic plugin. The post_id parameter, supplied by the client during an AJAX request, flows into a database query without proper escaping or use of prepared statements. Because the plugin registers the AJAX action for unauthenticated visitors using wp_ajax_nopriv_tf_room_availability, the attacker does not need an account on the target WordPress site. The plugin emits the required nonce on the public single-hotel page template, removing the nonce as a meaningful access barrier.

The weakness is classified as Improper Neutralization of Special Elements used in an SQL Command [CWE-89]. The relevant code paths are visible in inc/Classes/Helper.php and inc/Classes/Hotel/Hotel.php in the plugin source tree. See the WordPress Tourfic Helper Code and WordPress Tourfic Hotel Code references for the affected lines.

Root Cause

The plugin builds SQL statements by string concatenation rather than using WordPress's $wpdb->prepare() placeholders. User input passed in the post_id parameter is not cast to an integer or escaped, allowing additional SQL clauses to be appended to the original query.

Attack Vector

An unauthenticated attacker first retrieves a valid nonce by requesting any public single-hotel page. The attacker then submits a crafted POST request to admin-ajax.php targeting the tf_room_availability action with a malicious post_id value containing SQL syntax such as UNION SELECT clauses. The injected query executes within the WordPress database context and returns data through the AJAX response or via blind techniques.

No verified public exploit code is available. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-12937

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with action=tf_room_availability containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in the post_id parameter
Repeated AJAX requests from a single source iterating post_id values with unusual payloads
WordPress database error entries in PHP logs referencing the Tourfic plugin classes
Unexpected outbound responses with large JSON payloads from the tf_room_availability endpoint

Detection Strategies

Inspect web access logs for tf_room_availability requests containing URL-encoded SQL metacharacters in post_id
Deploy web application firewall rules that flag SQL syntax in POST parameters to admin-ajax.php
Correlate nonce retrieval from single-hotel pages followed by rapid AJAX calls to room availability
Monitor MySQL slow query logs for anomalous queries originating from the Tourfic code paths

Monitoring Recommendations

Enable WordPress debug logging and forward PHP errors to a centralized log platform
Alert on HTTP 500 responses from admin-ajax.php correlated with the tf_room_availability action
Track baseline request volumes to the affected AJAX endpoint and alert on deviations
Review database user activity for the WordPress account to detect unusual SELECT patterns against wp_users or wp_options

How to Mitigate CVE-2026-12937

Immediate Actions Required

Update the Tourfic plugin to a version newer than 2.22.7 once released by the vendor
If no fixed version is available, deactivate the Tourfic plugin until a patch is published
Rotate WordPress secret keys and database credentials if exploitation is suspected
Audit the wp_users and wp_options tables for unauthorized read activity or account changes

Patch Information

The vendor changeset addressing the issue is tracked in the WordPress Tourfic Changeset. Site administrators should apply the fixed plugin release through the WordPress admin dashboard or by replacing the plugin directory with the patched source.

Workarounds

Block requests to admin-ajax.php where the action parameter equals tf_room_availability at the WAF until patched
Restrict access to the affected hotel pages and AJAX endpoint by IP allowlist where feasible
Apply a virtual patch that rejects non-numeric values in the post_id parameter
Run the WordPress database user with the least privileges necessary, removing FILE and write privileges on non-essential tables

bash

# Example nginx rule to block SQL metacharacters in tf_room_availability requests
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "tf_room_availability") {
        if ($request_body ~* "(union|select|sleep|information_schema|--|/\*)") {
            return 403;
        }
    }
}