An unauthenticated SQL injection vulnerability in the TrueBooker plugin for WordPress poses a critical risk of database information disclosure.

This is an SQL injection vulnerability occurring due to improper neutralization of special elements in database queries. It allows an unauthenticated attacker to manipulate backend queries without requiring any user interaction or privileges.

Successful exploitation allows unauthorized parties to access, modify, or delete sensitive information stored in the WordPress database. Given the CVSS score of 9.3, this vulnerability represents a severe risk that could lead to full database compromise, potentially exposing customer PII or administrative credentials.

Immediate Action: Update the TrueBooker WordPress plugin to version 1.2.4 or higher immediately to apply the vendor-supplied security fix.

Proactive Monitoring: Review database query logs for anomalous patterns or unexpected syntax that may indicate automated SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads targeting WordPress plugins.

Public Exploit Available: Unknown

The critical nature of this vulnerability necessitates immediate patching. Organizations utilizing the TrueBooker plugin must verify their current version and upgrade to 1.2.4 or later as a priority to prevent potential data breaches.