What is the CVSS score of CVE-2026-13161?

CVE-2026-13161 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

TrueBooker CVE-2026-13161

EUVD-2026-49722 HIGH

SQL Injection (CWE-89)

2026-07-28 security@wordfence.com

GHSA-xm72-j57q-p3m6

WordPress SQLi

7.5

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network attack, no privileges or user interaction required, scope unchanged, only confidentiality affected, consistent with description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 09:30 vuln.today

CVE Published

Jul 28, 2026 - 09:16 nvd

HIGH 7.5

DescriptionCVE.org

The TrueBooker - Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldata[truebooker_user]' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The check_ajax_referer() nonce guard does not constitute an authentication or authorization barrier because the nonce is exposed to unauthenticated visitors on TrueBooker front-end booking pages; exploitation additionally requires that the required booking fields (category, service, person, date, and time slot) be present in the alldata POST parameter so that execution reaches the vulnerable SQL query branch.

Articles & Coverage 1

News 19 New WordPress Vulnerabilities - 2 Critical, 17 High Jul 29, 2026

AnalysisAI

Unauthenticated SQL injection in the TrueBooker WordPress plugin allows remote attackers to extract sensitive database information. The vulnerability resides in the 'alldata[truebooker_user]' parameter and affects versions up to and including 1.2.2. Although a nonce is used, it is exposed on front-end booking pages, enabling unauthenticated exploitation if the required booking fields are present.

Technical ContextAI

The vulnerability is in the TrueBooker - Appointment Booking and Scheduler System plugin for WordPress, specifically in the file main/function_ajax.php, where user-supplied data from the 'alldata[truebooker_user]' parameter is incorporated into an SQL query without sufficient escaping or parameterization. This falls under CWE-89 (SQL Injection). The affected product is the WordPress plugin 'truebooker-appointment-booking', version 1.2.2 and earlier, as shown by the plugin's SVN repository references.

RemediationAI

Upgrade the TrueBooker plugin to a version newer than 1.2.2. A fix has been committed to the plugin's trunk, as shown in the changeset comparison between version 1.2.2 and the development trunk. Until an official patched release is published, monitor the plugin's WordPress.org page for an update. If immediate update is not feasible, consider temporarily disabling the plugin; blocking access to booking pages may break functionality. No specific later release version is confirmed from the provided references.