CVE-2026-13161 is an SQL Injection vulnerability in the themetechmount TrueBooker plugin for WordPress affecting all versions up to and including 1.2.2. The vulnerability arises from insufficient escaping and lack of proper preparation of the 'alldata[truebooker_user]' parameter in SQL queries. The check_ajax_referer() nonce guard does not provide authentication or authorization protection since the nonce is exposed to unauthenticated visitors. Attackers can exploit this by sending specially crafted POST requests containing required booking fields to inject SQL commands, potentially extracting sensitive information from the database.

An unauthenticated attacker can exploit this vulnerability to perform SQL Injection attacks, allowing them to extract sensitive information from the backend database. The vulnerability does not affect integrity or availability directly but compromises confidentiality. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin or disable it if possible. Monitor for updates from the vendor themetechmount and apply patches promptly once released. Avoid exposing the vulnerable plugin on publicly accessible sites without additional protective controls.