CVE-2024-6924 is a critical severity (CVSS 9.8) SQL injection in the TrueBooker appointment booking plugin for WordPress, in versions before 1.0.3. It can be triggered by visitors who are not logged in. Update the plugin to 1.0.3 or later, which the WPScan entry lists as the fixed version.
What's affected
The affected software is the TrueBooker WordPress plugin, with the slug truebooker-appointment-booking. The NVD record says versions before 1.0.3 are vulnerable, and WPScan's entry says it is fixed in 1.0.3. The two sources agree.
They disagree on severity. The NVD record scores it 9.8, critical, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. WPScan's entry rates it 8.6, high. WPScan lists Project Black as the original researcher and the entry is marked as verified. Both figures describe the same flaw, so the safe reading is to treat this as an urgent fix on any public site.
WPScan's title says "multiple" unauthenticated SQL injection issues, so more than one input in the plugin may have been affected. The NVD description speaks of one parameter reached through an action open to unauthenticated users. Updating to 1.0.3 covers whatever the vendor fixed in that release.
The weakness is CWE-89, improper neutralization of special elements used in an SQL command.
How to check if you're exposed
On a server with WP-CLI:
wp plugin list --fields=name,status,version | grep -i truebooker
Or in the dashboard, open Plugins and find TrueBooker. If the version is below 1.0.3, you are exposed whether the plugin is active or not, because the plugin files are still on disk. Deactivated plugin files can sometimes still be reached directly, so deleting an unused plugin is safer than leaving it.
To check many sites, run the same WP-CLI command on each, or use a dependency scan that reads the plugin versions. The free in-browser scan at gold.safeguard.sh/scan can help with the application dependencies that sit next to WordPress.
What to do now
- Update TrueBooker to 1.0.3 or later from the WordPress plugin screen or with
wp plugin update. - If you do not use the plugin, deactivate it and delete it.
- Check the database for unexpected new administrator accounts or changed options, and review web server logs for unusual requests to the plugin's endpoints.
- If you cannot rule out misuse, rotate WordPress salts, reset administrator passwords, and rotate the database password.
- Keep recent backups, and test that a restore works.
Why it matters
The plugin builds a database query from a request value without escaping it properly. Because the entry point is reachable without logging in, anyone on the internet can send requests to it. SQL injection can let an attacker read data they should not see, and depending on the database permissions, change it. That explains the high confidentiality, integrity and availability impact in the vector.
Booking plugins hold customer names, contact details and appointment data, which makes the stored data worth caring about. CISA does not list this CVE as known exploited, and the sources do not report exploitation in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to be logged in to be attacked?
No. The record says the vulnerable action is available to unauthenticated users.
Which severity is right, 9.8 or 8.6?
The NVD record says 9.8 and WPScan says 8.6. Both put it in the urgent range, and the fix is the same, version 1.0.3.
Sources
Last reviewed: 19 October 2026.
