Junglewise Threat Intelligence

CVE-2026-13161: themetechmount TrueBooker SQL injection in alldata parameter

CVE-2026-13161 · Severity: high · CVSS 7.5 · Published 2026-07-28

Executive brief

TrueBooker is a WordPress plugin used to manage appointment bookings and scheduling on websites. A security flaw in this plugin allows unauthorized individuals to access sensitive information stored in the website's database. This could lead to the exposure of customer data or internal site configurations, potentially damaging the organization's reputation and compromising user privacy.

Technical details

The vulnerability is a generic SQL Injection (CWE-89) located in the 'alldata[truebooker_user]' parameter within the plugin's AJAX functionality. The root cause is insufficient escaping of user-supplied input and a lack of SQL query preparation. Although the plugin uses check_ajax_referer(), this does not provide security as the required nonce is exposed to unauthenticated visitors on front-end booking pages. To successfully exploit the flaw, an attacker must include specific booking fields (category, service, person, date, and time slot) in the POST request to reach the vulnerable code path. Successful exploitation allows for unauthorized data extraction from the WordPress database.

Affected products

  • themetechmount TrueBooker – Appointment Booking and Scheduler System up to, and including, 1.2.2

Timeline

  • 2026-07-28: advisory: Initial disclosure by Wordfence and NVD publication

References