CVE-2026-13161 in TrueBooker Plugin
Summary
by MITRE • 07/28/2026
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldata[truebooker_user]' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The check_ajax_referer() nonce guard does not constitute an authentication or authorization barrier because the nonce is exposed to unauthenticated visitors on TrueBooker front-end booking pages; exploitation additionally requires that the required booking fields (category, service, person, date, and time slot) be present in the alldata POST parameter so that execution reaches the vulnerable SQL query branch.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/28/2026
The vulnerability in the TrueBooker WordPress plugin represents a critical generic SQL injection flaw that undermines database security through improper input sanitization. This weakness exists in versions up to and including 1.2.2 where the parameter 'alldata[truebooker_user]' receives insufficient escaping before being incorporated into SQL queries. The vulnerability stems from inadequate preparation of database queries, allowing attackers to inject malicious SQL code that can manipulate existing queries rather than simply bypassing them. This type of vulnerability falls under CWE-89 which specifically addresses SQL injection flaws where untrusted data is incorporated into SQL commands without proper sanitization or parameterization.
The operational impact of this vulnerability extends beyond simple data extraction to potentially enable full database compromise through chained attacks that could escalate privileges, modify sensitive records, or even facilitate further exploitation within the WordPress environment. Attackers can leverage the exposed nonce mechanism which fails to provide meaningful authentication since it's accessible to unauthenticated visitors on front-end booking pages. This exposure fundamentally undermines the security model of the plugin as the check_ajax_referer() function serves merely as a superficial barrier rather than a genuine access control mechanism.
The exploitation requirements for this vulnerability include the presence of specific booking fields within the alldata POST parameter, particularly category, service, person, date, and time slot elements. This constraint means that attackers must first identify valid booking page endpoints before attempting injection attacks, though the lack of proper input validation still leaves the system vulnerable once these conditions are met. The vulnerability creates a pathway for unauthorized information disclosure that could expose user data, booking records, and potentially system configuration details stored within the database.
Mitigation strategies should focus on implementing proper parameterized queries with strict input validation and sanitization of all user-supplied data before database insertion. The nonce verification mechanism must be strengthened to ensure it operates as a true authentication barrier rather than a simple access control check. Additionally, implementing proper authorization checks and removing exposed sensitive data from front-end interfaces will significantly reduce the attack surface. Organizations should also consider implementing web application firewalls and database activity monitoring to detect and prevent exploitation attempts. This vulnerability demonstrates the critical importance of following secure coding practices and proper input validation as outlined in OWASP Top Ten and NIST cybersecurity guidelines, where SQL injection remains consistently ranked among the most severe web application vulnerabilities requiring immediate remediation.