TrueBooker CVE-2026-94228

Exploitation requires that the target site run the TrueBooker WordPress plugin at a version before 1.3.0 and that the vulnerable setup handler be reachable. The specific prerequisite is possession of the setup token the handler validates - but because that token is issued to unauthenticated visitors, it is not a meaningful barrier, and the handler performs no WordPress capability check. There is no required authentication (PR:N), no user interaction (UI:N), and no non-default configuration needed per the available data; the only practical limiting factors are that the affected plugin must be installed and at a vulnerable version, and that impact is bounded to overwriting plugin configuration (Integrity) rather than disclosing data or executing code.

This is a moderate-severity integrity issue, not a top-tier priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:L/A:N, base 5.3) indicates a remotely reachable, low-complexity, unauthenticated flaw with no confidentiality impact and only Low integrity impact - consistent with the description of overwriting plugin configuration rather than achieving code execution or data theft. Publicly available exploit code exists (reported by WPScan), which raises the practical likelihood of opportunistic abuse against unpatched sites, but the flaw is NOT listed in CISA KEV, so there is no confirmed active exploitation. No EPSS score and no SSVC decision data were provided, so automatability and exploitation-status signals cannot be cross-referenced - this is a gap. The main signals (unauthenticated + network + public POC) point to easy exploitation, while the capped Low integrity impact and absence of confidentiality/availability impact limit real-world severity. Note a tagging inconsistency: the input tags this as 'Information Disclosure,' but the CVSS vector shows C:N (no confidentiality impact) and the described effect is configuration overwrite - this is an integrity/authorization flaw, not disclosure; verify intended impact with the WPScan advisory.

An unauthenticated attacker obtains the visitor-issued token that the vulnerable setup handler checks, then sends a crafted request to the handler to overwrite the TrueBooker plugin's entire configuration, dropping any settings not included in the request. Because public exploit code is available via WPScan and no authentication or user interaction is required, this can be scripted against any reachable unpatched site running the plugin before version 1.3.0.