What is the CVSS score of CVE-2026-1797?

CVE-2026-1797 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-1797

EUVD-2026-17317 MEDIUM

Missing Authorization (CWE-862)

2026-03-31 Wordfence

WordPress Information Disclosure Authentication Bypass PHP

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 31, 2026 - 05:15 euvd

EUVD-2026-17317

Analysis Generated

Mar 31, 2026 - 05:15 vuln.today

CVE Published

Mar 31, 2026 - 04:25 nvd

MEDIUM 5.3

DescriptionCVE.org

The Appointment Booking and Scheduler Plugin - Truebooker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 through views php files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed views php files via direct access.

AnalysisAI

Unauthenticated attackers can directly access view PHP files in the Truebooker WordPress plugin (versions up to 1.1.4) to disclose sensitive information, such as user data or system configuration details exposed in those templates. The vulnerability requires only network access and no authentication, making it trivially exploitable via simple HTTP requests to exposed PHP files. No public exploit code or active exploitation has been confirmed at this time.

Technical ContextAI

The Truebooker plugin for WordPress stores template logic in publicly accessible PHP files within the views directory. The vulnerability stems from a failure to implement proper access controls (CWE-862: Missing Authorization) on these view files, which are often intended to be executed only within the WordPress plugin framework context. When an attacker directly requests these PHP files via HTTP (e.g., /wp-content/plugins/truebooker-appointment-booking/main/views/truebooker-user.php), the web server may execute them outside the intended context or expose their source code, revealing database queries, hardcoded credentials, user information structures, or other sensitive implementation details typically hidden behind WordPress's authorization layer. The issue affects the plugin across all versions through 1.1.4, as reported by Wordfence security research.

RemediationAI

Update the Truebooker plugin to a version later than 1.1.4 that implements proper access controls on view PHP files, preventing direct HTTP access to sensitive templates. If an updated version is not immediately available, implement server-level access restrictions by adding .htaccess rules or web server configuration to deny direct requests to PHP files in the /wp-content/plugins/truebooker-appointment-booking/main/views/ directory, or use WordPress security plugins to enforce access controls. Additionally, review the WordPress plugins directory at https://plugins.trac.wordpress.org/ for security advisories and any patched version releases. Site administrators should audit their web server logs for unauthorized access attempts to view files as a precautionary measure.