What is the CVSS score of CVE-2026-12937?

CVE-2026-12937 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Tourfic Plugin are affected by CVE-2026-12937?

The Tourfic WordPress travel-booking plugin (versions ≤2.22.7) contains an unauthenticated SQL injection vulnerability allowing remote attackers to extract entire databases without authentication.

How to fix or mitigate CVE-2026-12937?

24 hours: Disable the Tourfic plugin immediately; deploy WAF rules to block requests to tf_room_availability AJAX action. 7 days: Query database access logs for exploitation indicators; audit scope of customer data exposure; identify alternative travel booking solutions. 30 days: If vendor releases patched version, test in staging environment before production deployment; otherwise migrate to alternative plugin or suspend booking functionality.

Tourfic Plugin CVE-2026-12937

EUVD-2026-39189 HIGH

SQL Injection (CWE-89)

2026-06-25 Wordfence

GHSA-79gf-4fr3-w2q9

WordPress SQLi Wordpress Plugin Tourfic Ai Powered Travel Booking Hotel Booking Car Rental Wordpress Plugin Themefic

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Endpoint is network-reachable with a freely obtainable nonce, so PR:N/UI:N/AC:L; injection extracts data only, giving C:H with I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 08:16 vuln.today

CVE Published

Jun 25, 2026 - 06:51 cve.org

HIGH 7.5

DescriptionCVE.org

The Tourfic - AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'post_id' parameter in all versions up to, and including, 2.22.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The AJAX handler is registered for unauthenticated users via wp_ajax_nopriv_tf_room_availability, and the required nonce is emitted on the public single-hotel page template, allowing unauthenticated attackers to freely obtain a valid nonce and reach the vulnerable code path.

Articles & Coverage 1

News 7 New WordPress Vulnerabilities - 1 Critical, 6 High, 2 With POC Jun 26, 2026

AnalysisAI

Unauthenticated SQL injection in the Tourfic WordPress travel-booking plugin (versions through 2.22.7) lets remote attackers read arbitrary database contents via the 'post_id' parameter of the tf_room_availability AJAX action. Because the action is registered for logged-out users (wp_ajax_nopriv) and the required nonce is publicly emitted on single-hotel pages, no authentication is needed in practice. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

This is a CWE-89 SQL Injection defect in a WordPress plugin's room-availability lookup. The plugin builds a SQL query incorporating the user-supplied 'post_id' value without sufficient escaping and without a parameterized/prepared statement (WordPress $wpdb->prepare). Per the Wordfence trac references, the vulnerable logic resides in inc/Classes/Hotel/Hotel.php (around lines 305 and 543) and inc/Classes/Helper.php (around line 1164). The affected component (CPE cpe:2.3:a:themefic:tourfic_-_ai_powered_travel_booking,_hotel_booking_&_car_rental_wordpress_plugin) is the AJAX endpoint tf_room_availability, which an unauthenticated visitor can invoke because of the nopriv registration combined with the publicly exposed nonce.

RemediationAI

Update the Tourfic plugin to the first release after 2.22.7 that contains the fix; an upstream fix is available via the WordPress.org SVN changeset (3584747@tourfic), but the exact patched release version is not independently confirmed in the available data, so verify the fixed version against the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/12c29a44-f9e4-439a-bc3f-18a3640f7924?source=cve) before deploying. Until patched, restrict reach to the vulnerable endpoint: deploy a WAF rule blocking SQL metacharacters in the 'post_id' parameter of admin-ajax.php requests using action=tf_room_availability (trade-off: scope it to non-numeric input to avoid false-positives on legitimate numeric post IDs), or temporarily disable or restrict the single-hotel booking pages that emit the nonce (trade-off: breaks public booking functionality). Monitor admin-ajax.php logs for tf_room_availability requests carrying SQL syntax.