Tourfic Plugin CVE-2026-12937

Exploitation requires that the public single-hotel page template be reachable so the attacker can harvest the valid nonce gating the tf_room_availability AJAX action, and that an affected plugin version (≤ 2.22.7) be active with the nopriv AJAX handler registered (default behavior). Given AV:N/AC:L/PR:N/UI:N there is effectively no authentication or user-interaction barrier - the nonce is not a genuine limiter because it is emitted on the public page. The only practical limiting factors are that a published/accessible hotel listing page must exist to source the nonce and the site must run a vulnerable plugin version; there is no privilege, MFA, or non-default-configuration requirement.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5 HIGH) is internally consistent with the description: network-reachable, low-complexity, no privileges, no user interaction, and confidentiality-only impact since the injection extracts rather than modifies data. The nonce - normally a mitigating control - is neutralized because it is freely obtainable from the public hotel page, so it does not raise effective privileges. EPSS is not provided, the CVE is not in CISA KEV, and no POC is referenced, so there is no evidence of active exploitation despite the high CVSS. The principal real-world amplifier is that unauthenticated SQLi in WordPress plugins is routinely automated by mass scanners shortly after disclosure; the principal dampener is the niche footprint of this specific plugin.

An unauthenticated attacker loads a public single-hotel page to scrape the valid nonce, then sends a crafted POST to admin-ajax.php with action=tf_room_availability and a malicious 'post_id' value appending a UNION or stacked subquery, causing the response to return WordPress user records, password hashes, or other sensitive table data. No public exploit code is identified at time of analysis, but the low attack complexity (AC:L) makes weaponization straightforward.