Truebooker CVE-2026-39663

The TrueBooker plugin must be installed and activated on the WordPress site. The vulnerability is triggered when unauthenticated attackers send requests to the plugin's REST API endpoints or AJAX handlers that perform booking modifications. No special WordPress configuration, plugin settings, or user interaction is required; the broken access control affects the default plugin behavior.

The CVSS 5.3 (Network, Low Complexity, No Privileges Required, No User Interaction) indicates a straightforward network attack with low bar to exploitation. However, the EPSS score of 0.02% (4th percentile) dramatically downrates real-world risk, suggesting minimal observed exploitation activity despite public disclosure. This is typical of plugin-specific vulnerabilities with narrower attack surface than OS or browser flaws. The Integrity impact (I:L) confirms attackers can modify booking data, which-while serious for business continuity-does not constitute RCE or full system compromise. The lack of Confidentiality or Availability impact limits blast radius. No KEV status or active exploitation confirmations provided. Real-world risk depends on: (1) whether plugins auto-update in target environments, (2) whether booking data modification triggers fraud/reputation harm, and (3) whether API endpoints are exposed to untrusted networks.

An unauthenticated attacker discovers the TrueBooker plugin is active on a WordPress site by enumerating the /wp-content/plugins/ directory or analyzing HTTP responses. The attacker sends a crafted HTTP request to the plugin's REST API or AJAX endpoint that modifies booking records (creating fake appointments, canceling legitimate bookings, or changing booking status) without providing valid authentication credentials. Since the plugin fails to validate authorization, the request succeeds, allowing the attacker to disrupt the booking system or trigger downstream fraud.