Attack Chain

1. Reconnaissance: An unauthenticated attacker identifies a WordPress site utilizing the vulnerable TrueBooker - Appointment Booking and Scheduler System plugin (version 1.2.2 or earlier).
2. Nonce Collection: The attacker accesses a front-end booking page served by the TrueBooker plugin to retrieve a valid anti-CSRF nonce value, which is exposed in the page's source code.
3. Payload Crafting: The attacker crafts a malicious HTTP POST request to a TrueBooker AJAX endpoint, including the previously collected nonce and all required booking fields (category, service, person, date, time slot) within the alldata POST parameter.
4. SQL Injection: Within the alldata[truebooker_user] sub-parameter of the POST request, the attacker embeds an SQL injection payload designed to manipulate the database query (e.g., UNION SELECT statements).
5. Exploitation Attempt: The crafted POST request is sent to the vulnerable endpoint, triggering the plugin's logic to process the booking parameters.
6. Malicious Query Execution: Due to insufficient escaping and preparation, the plugin concatenates the attacker's SQL injection payload directly into a database query. The database then executes this manipulated query.
7. Data Extraction: The executed malicious query causes the database to return sensitive information (e.g., user hashes, system configurations, private data) in the HTTP response, which the attacker collects.

Impact

Successful exploitation of CVE-2026-13161 allows unauthenticated attackers to extract arbitrary sensitive information directly from the compromised WordPress database. This can include user credentials, personal data of clients, website configuration details, or other proprietary information stored within the database. The ease of exploitation, given the public exposure of the nonce and unauthenticated nature, makes this a high-risk vulnerability, potentially leading to significant data breaches and further compromise of the WordPress installation.

Recommendation

• Patch CVE-2026-13161 by updating the TrueBooker - Appointment Booking and Scheduler System plugin to version 1.2.3 or higher immediately on all affected WordPress installations.
• Monitor webserver access logs for POST requests containing common SQL injection characters in the cs-uri-query or cs-raw-body fields, especially targeting admin-ajax.php or other plugin-related endpoints.
• Deploy the Sigma rule "Detects CVE-2026-13161 Exploitation - TrueBooker WordPress SQLi" to your SIEM and tune for your environment, paying close attention to cs-uri-query patterns.