CVE-2026-13161: TrueBooker WordPress Plugin SQLi Flaw

CVE-2026-13161 Overview

CVE-2026-13161 is an unauthenticated SQL Injection vulnerability [CWE-89] in the TrueBooker – Appointment Booking and Scheduler System plugin for WordPress. All versions up to and including 1.2.2 are affected. The flaw resides in the alldata[truebooker_user] parameter processed by the plugin's AJAX booking handler in function_ajax.php. Insufficient escaping and the absence of prepared statements allow attackers to append arbitrary SQL to existing queries. The check_ajax_referer() nonce check does not act as an authorization barrier because the nonce is exposed to unauthenticated visitors on public booking pages.

Critical Impact
Unauthenticated attackers can extract sensitive data from the WordPress database, including user credentials, session tokens, and personally identifiable information from booking records.

Affected Products

TrueBooker – Appointment Booking and Scheduler System plugin for WordPress, versions ≤ 1.2.2
WordPress sites exposing the plugin's front-end booking pages to the public internet
Any deployment where the plugin's AJAX endpoint in function_ajax.php is reachable

Discovery Timeline

2026-07-28 - CVE-2026-13161 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-13161

Vulnerability Analysis

The vulnerability is a generic SQL Injection [CWE-89] reachable over the network without authentication. An attacker sends a crafted POST request to the plugin's AJAX booking handler. The alldata[truebooker_user] field is concatenated into a SQL statement without proper escaping or parameter binding. Because the query is not prepared with $wpdb->prepare(), appended SQL syntax is executed by the database. Successful exploitation permits data exfiltration through UNION-based or time-based blind techniques. The impact is scoped to confidentiality of stored records; integrity and availability are not directly affected according to the CVSS vector.

Root Cause

The root cause is a combination of two coding defects in function_ajax.php around lines 14741, 14756, and 14866. First, user-controlled input from the alldata POST array is inserted into SQL strings without sanitization via esc_sql() or type casting. Second, the resulting query is executed without the WordPress $wpdb->prepare() placeholder mechanism. The check_ajax_referer() guard is present but ineffective as an access control because the nonce token is rendered into public booking pages served to anonymous visitors.

Attack Vector

Exploitation requires network access to a WordPress site running TrueBooker with a front-end booking page. The attacker first retrieves the AJAX nonce from any public booking page. The attacker then submits a POST request to the WordPress admin-ajax.php endpoint containing the required booking fields (category, service, person, date, and time slot) so that execution reaches the vulnerable branch. The malicious payload is placed in alldata[truebooker_user]. No user interaction and no privileges are required. Refer to the Wordfence Vulnerability Report for the vulnerable code paths and the WordPress Plugin Changeset for the applied fix.

Detection Methods for CVE-2026-13161

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with an action targeting TrueBooker booking submission and SQL metacharacters (', UNION, SELECT, --, SLEEP() inside alldata[truebooker_user].
Web server logs showing repeated booking submissions from the same IP with varying alldata[truebooker_user] payloads.
Database error entries or unusually long query execution times correlated with booking AJAX requests.

Detection Strategies

Deploy WAF signatures that inspect POST bodies for SQL Injection patterns within alldata[...] parameter keys.
Enable slow-query logging on MySQL/MariaDB to identify time-based blind SQLi attempts using SLEEP() or BENCHMARK().
Audit installed plugin versions against WordPress plugin inventories to flag TrueBooker installations at or below 1.2.2.

Monitoring Recommendations

Alert on anomalous outbound data volumes from the web server following booking AJAX activity.
Monitor wp_users, wp_usermeta, and booking tables for unexpected read patterns via database audit logging.
Track HTTP 500 responses from admin-ajax.php that may indicate failed injection probes.

How to Mitigate CVE-2026-13161

Immediate Actions Required

Update the TrueBooker – Appointment Booking and Scheduler System plugin to the version released after 1.2.2 that contains the fix from changeset 3591506.
If an immediate update is not possible, deactivate and remove the plugin from the WordPress installation.
Rotate WordPress administrator passwords and any secrets stored in the database once the patch is applied.

Patch Information

The vendor addressed the vulnerability in the changeset published on the WordPress plugin repository. The fix introduces proper input sanitization and uses prepared statements for the affected queries in function_ajax.php. Review the WordPress Plugin Changeset and the Wordfence Vulnerability Report for remediation guidance.

Workarounds

Restrict access to booking pages behind authentication or IP allow-listing until the plugin is updated.
Deploy a Web Application Firewall rule blocking SQL metacharacters in the alldata[truebooker_user] POST parameter.
Grant the WordPress database user only the minimum privileges required, revoking FILE and cross-database SELECT where not needed.

bash

# Example WAF rule (ModSecurity) to block SQLi patterns in the vulnerable parameter
SecRule ARGS:'alldata[truebooker_user]' "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|benchmark\s*\(|--|';)" \
    "id:1026013161,phase:2,deny,status:403,log,msg:'CVE-2026-13161 TrueBooker SQLi attempt blocked'"