Truebooker
CVE-2024-6925
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS score of 4.3 (MEDIUM). Attack characteristics: network attack vector, low complexity, no privileges required, user interaction required. Public proof-of-concept exploit code is available. |
| Exploit ScenarioDerived | A remote attacker could trick authenticated users into performing unintended actions by sending crafted requests to the affected application. No authentication is required to exploit this vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement anti-CSRF tokens, validate Origin/Referer headers, use SameSite cookie attribute.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352), which allows attackers to trick authenticated users into performing unintended actions. The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Affected products include: Themetechmount Truebooker. Version information: before 1.0.3.
Know when Truebooker gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionNVD
The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Affected Products (CPE)NVD
More in Truebooker
View allAccount takeover in TrueBooker WordPress plugin before 1.2.4 enables unauthenticated attackers to reset any user’s passw
The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL
Privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin through version 1.2.3 lets unau
Unauthenticated privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin versions 1.2.6
Unauthenticated SQL injection in the TrueBooker (truebooker-appointment-booking) WordPress plugin by themetechmount affe
TrueBooker, a WordPress booking/appointment plugin, renders a booking confirmation summary without verifying that the re
Missing authorization checks in the TrueBooker WordPress plugin before 1.3.0 allow unauthenticated remote attackers to c
Unauthenticated attackers can create TrueBooker bookings at attacker-chosen prices and attach them to arbitrary customer
TrueBooker, a WordPress plugin, lets unauthenticated remote attackers rewrite its entire stored configuration because on
Unauthenticated broken access control in the TrueBooker WordPress appointment-booking plugin (versions ≤ 1.1.9 by ThemeT
Unauthenticated settings modification in the TrueBooker appointment-booking WordPress plugin (versions 1.2.9 and earlier
TrueBooker appointment booking plugin through version 1.1.5 fails to enforce proper authorization controls, allowing una
GitHub PoC
Exploit-DB