External risk intelligence

TrueBooker Unauthenticated SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-61950

The vulnerability exists in a WordPress plugin used for appointment booking. Such plugins are designed to be publicly accessible to site visitors for scheduling purposes, making the affected interface a public-facing web service by design.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An unauthenticated SQL injection vulnerability has been identified in the TrueBooker software, affecting its appointment booking functionality. This issue could allow unauthorized access to sensitive data within the application. The main concern is to confirm whether your organization utilizes this specific software and, if so, to assess potential exposure.

Allows unauthorized data access.
Confirms relevance and potential exposure.
Verify use; assess risk if impacted.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can target the TrueBooker appointment booking plugin through a network connection. By sending specially crafted SQL queries, they can exploit a weakness to manipulate the database. This could potentially lead to unauthorized access to sensitive information or disruption of the booking service.

Accessible via the network.
SQL injection vulnerability.
Data exposure and service disruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious SQL code into the application when supported conditions are met. This could potentially lead to unauthorized access to sensitive data stored in the database.

Database data could be at risk.
Via unauthenticated SQL injection.
Unauthorized data access may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated SQL injection vulnerability in TrueBooker affects publicly accessible appointment booking interfaces. The first practical step is to identify all instances of TrueBooker, confirm their internet reachability and business criticality, and then determine the accountable owner for remediation. This process should involve application owners and potentially infrastructure or security teams to assess exposure and plan coordinated mitigation.

Application owners should own this issue.
Verify external reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is TrueBooker?

TrueBooker is a WordPress plugin designed to handle appointment booking. It allows website visitors to schedule meetings or services directly through a web interface, acting as a bridge between the public-facing site and the underlying database.

What does SQL injection mean for CVE-2026-61950?

This CVE involves CWE-89, which occurs when software fails to properly filter user input before using it in a database query. In this case, it allows an attacker to inject their own malicious SQL commands. This can trick the database into revealing sensitive information it should not expose, bypassing standard application security controls.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending specifically crafted, malicious web requests to the TrueBooker plugin. The vulnerability does not require the attacker to have an account or be logged in. It will not be triggered by legitimate, standard interactions from users who are simply browsing or making valid appointment bookings.

Is my site at risk if I use TrueBooker?

According to Halo Surface Signal, this software is inherently designed to be public-facing to enable scheduling. Because it resides on the web, any internet-connected instance of TrueBooker is reachable by remote attackers, significantly increasing the relevance of this vulnerability for any organization running the plugin.

What should I do if I am running TrueBooker?

Begin by auditing your systems to locate every instance of the TrueBooker plugin currently in use. Once identified, evaluate the business criticality of those specific sites and determine who is responsible for their maintenance. Coordinate with the relevant application or site owners to prepare for updates or other security mitigations as they become available.

References

patchstack.com/database/wordpress/plugin/truebooker-appointment-book…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.