An attacker can supply a crafted value to the alldata[truebooker_user] parameter in a POST request without needing any authentication. Because the plugin fails to properly escape or prepare that value, the request can inject arbitrary SQL statements that are appended to an existing query. The vulnerability, classified as CWE-89, allows an attacker to read sensitive data from the database such as user credentials and booking details. The potential impact is the disclosure of confidential information and the risk of further exploitation if additional weaknesses are discovered in the affected system.

All installations of the TrueBooker – Appointment Booking and Scheduler System plugin from ThemeTechMount that are version 1.2.2 or earlier are affected. The flaw exists in every release up to and including 1.2.2 and is presumed fixed in later releases, although no official patch version is explicitly cited in the advisory.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests that the probability of exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through a standard booking form submission to the function_ajax.php AJAX endpoint, which must include the booking fields category, service, person, date, and time slot. Because the nonce guard is exposed to unauthenticated visitors, it does not provide protection. Once the conditions are met, the attacker can retrieve database contents but does not gain remote code execution.