CVE-2026-12937: SQL Injection in Tourfic WordPress Plugin – Security Advisory

Technical summary

CVE-2026-12937 is a generic SQL injection vulnerability (CWE-89) in the Tourfic plugin's AJAX handler 'wp_ajax_nopriv_tf_room_availability'. The vulnerability stems from insufficient input escaping and lack of parameterized query preparation on the 'post_id' parameter. Because the AJAX action is registered for unauthenticated users via wp_ajax_nopriv_ hooks and the required WordPress nonce is embedded in the public single-hotel page template, attackers can obtain valid credentials and craft POST requests to execute arbitrary SQL statements. The vulnerability allows extraction of database contents but does not permit modification or deletion of data.

Business impact

Exploitation could expose sensitive travel booking data, customer personal information, payment details, and internal business logic stored in the WordPress database. For travel agencies or hotel operators relying on this plugin, a breach could result in customer privacy violations, regulatory compliance failures (GDPR, CCPA), reputational damage, and potential notification costs. The wide availability of the plugin means multiple websites may be simultaneously at risk if patches are not deployed promptly.

Affected systems

WordPress installations running the Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin in version 2.22.7 or earlier are affected. Any site using this plugin for hotel or travel booking functionality exposes its database to potential unauthorized access. The vulnerability does not require any user interaction or authentication, making all instances with the vulnerable plugin active on public-facing sites vulnerable.

Exploitability

Exploitability is very high. The attack requires only network access and can be performed by an unauthenticated attacker from anywhere. No special privileges, user interaction, or complex setup is needed. The nonce is publicly available on hotel pages, eliminating a typical WordPress security barrier. The attack is trivial to automate, making it likely to be rapidly weaponized once public awareness spreads.

Remediation

Immediately update the Tourfic plugin to a patched version that implements proper input escaping and parameterized SQL queries (verify the current patched version against the official plugin repository or vendor advisory). If an update is not yet available, consider temporarily disabling the plugin or restricting access to the affected AJAX handler through your web application firewall until a patch is released. Review database access logs and transaction records for signs of unauthorized queries during the exposure period.

Patch guidance

Verify the latest available version of the Tourfic plugin from the WordPress.org plugin directory or the vendor's official advisory. Update through the WordPress admin dashboard (Plugins > Installed Plugins > Update Available) or manually deploy the patched version. Test the update in a staging environment first to ensure compatibility with your booking workflows. After patching, confirm that hotel availability queries and room booking functionality operate normally.

Detection guidance

Monitor for POST requests to wp-admin/admin-ajax.php with the action parameter set to 'tf_room_availability' from untrusted sources. Look for SQL metacharacters or common SQL injection patterns in the 'post_id' parameter, such as single quotes, UNION keywords, or comment sequences (-- or /*). Enable query logging on your database server to identify anomalous SELECT statements targeting sensitive tables (wp_users, wp_options, or custom booking tables). Security plugins like Wordfence or iThemes Security can be configured to detect and block such patterns.

Why prioritize this

This vulnerability scores CVSS 7.5 (HIGH) due to its network-accessible nature, lack of authentication requirements, and high confidentiality impact. The public availability of the exploitation path and widespread deployment of WordPress plugins elevates real-world risk. While it does not permit data modification or denial of service, the confidentiality breach risk and ease of exploitation warrant priority patching before external actors automate attacks. Organizations running this plugin should treat this as urgent.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a high-severity vulnerability accessible over the network (AV:N) with low attack complexity (AC:L), no authentication required (PR:N), and no user interaction needed (UI:N). The impact is scoped to the affected system (S:U) with high confidentiality impact (C:H) due to unrestricted database query execution, while integrity and availability are not impacted (I:N/A:N). The public availability of the nonce and lack of account requirements make the baseline CVSS assessment conservative in real-world conditions.

Frequently asked questions