EUVD-2026-104103
GHSA-g786-x9wh-wcxq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach plugin confirmation endpoint remotely
-
ExploitEnumerate sequential booking identifiers
-
ExecutionRetrieve customer PII per booking
-
ImpactHarvest data / invalidate confirmation links
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | No authentication, special configuration, or user interaction is required: the flaw is reachable against a default installation of the TrueBooker WordPress plugin (versions before 1.3.0) because the confirmation-summary handler does not verify that the requester owns the booking it renders. The only practical prerequisite is that the site has active or historical bookings whose identifiers can be enumerated (identifiers appear guessable/sequential). Limiting factors: impact is confined to data exposed in the booking confirmation summary and to invalidating confirmation links - no broader site compromise - and the exposure ends once the site is upgraded to 1.3.0 or later. |
| Impact | This is a broken-access-control / insecure direct object reference (IDOR) information-disclosure flaw rated CVSS 5.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - network-reachable, low complexity, and no privileges or user interaction required, which maximizes ease of access, while the limited confidentiality-only impact (C:L) caps the score at Medium. Exploitation status: publicly available exploit code exists (reported by WPScan), but this CVE is NOT on CISA KEV and no EPSS score was supplied in the input, so there is no evidence of active or widespread exploitation - POC availability must not be conflated with in-the-wild use. The provided CVSS marks integrity and availability as None, yet the description explicitly states an attacker can 'invalidate the customer's own confirmation link,' which is an integrity/availability effect not reflected in the vendor vector - a conflict flagged below in confidence_notes and reflected in my independent assessment. Net: a real but modest priority - easy to exploit for data scraping of customer PII, but bounded impact and a niche plugin footprint make this lower urgency than its 'unauthenticated/network' signals alone might suggest. |
| Exploit ScenarioDerived | An unauthenticated attacker scripts sequential or guessed booking identifiers against the plugin's confirmation-summary endpoint and harvests the personal information (names, contact details, appointment data) of customers who booked appointments. A public exploit referenced by WPScan exists, and because the CVSS vector is AV:N/AC:L/PR:N/UI:N, the attack is fully remote, low-complexity, and requires no login or victim interaction. The attacker can additionally invalidate legitimate customers' confirmation links while enumerating. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
TrueBooker, a WordPress booking/appointment plugin, renders a booking confirmation summary without verifying that the requester actually owns the referenced booking, so anyone on the internet can walk booking identifiers and read the confirmation pages of other customers. That exposes customer personal information contained in the summary and also lets an attacker invalidate a victim's own confirmation link (a limited integrity impact on top of the disclosure). All versions before 1.3.0 are affected, no authentication or user interaction is required against a default installation, publicly available exploit code exists, and the issue is rated CVSS 5.3 (Medium) with confidentiality and limited integrity impact only.
RemediationAI
Upgrade the TrueBooker plugin to 1.3.0 or later, which is the vendor-released fix that adds the ownership check before the confirmation summary renders; verify the version in the WordPress admin Plugins list after updating and confirm the advisory at https://wpscan.com/vulnerability/6041298d-1e66-4fba-9cc1-7b55e591ffaf/ for the fixed-version confirmation. Because exploit code is publicly available, treat unpatched sites as exposed now: if the update cannot be applied immediately, the cleanest compensating control is to deactivate TrueBooker until it can be patched - the trade-off is that all booking functionality goes offline. A narrower alternative is to block or challenge unauthenticated requests that hit the booking-confirmation endpoint with a booking-identifier parameter (for example a WAF/reverse-proxy rule matching sequential numeric IDs or the confirmation query string), accepting the risk that legitimate customers following their own links may be blocked or must pass a challenge. You can also front the confirmation flow with an unguessable token requirement at the proxy layer, but that requires custom development and will break existing emailed links unless they are regenerated. Finally, enable and review web server/WordPress logs for rapid sequential enumeration of booking identifiers from a single source and rate-limit or block those clients at the edge; this reduces bulk harvesting but does not prevent targeted single-record disclosure, so it is a stopgap only. Do not rely on hiding the endpoint or renaming parameters as anything more than temporary obscurity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in the booking-confirmation handler of the TrueBooker WordPress plugin, which is a PHP application layered on WordPress's request lifecycle and database abstraction. The handler takes a booking identifier from the request and passes it straight to the query that builds the confirmation summary, with no capability check and no comparison between the booking's stored owner/customer record and the current session - the classic broken-access-control pattern of an insecure direct object reference (the authorization-bypass-through-user-controlled-key class, CWE-639), which also manifests as exposure of sensitive information (CWE-200). Because the plugin's booking identifiers appear to be guessable/sequential, an unauthenticated remote attacker can simply iterate values over the network (AV:N/AC:L/PR:N/UI:N) and harvest the rendered summaries, including whatever customer details the plugin prints back. The same unguarded handler permits state change on the target record's confirmation link, which is why the authoritative assessment adds a limited integrity component (I:L) beyond the description's confidentiality-only view. There is no server-side component such as memory corruption, injection, or deserialization involved, so exploitation cannot escalate past the data and link state the confirmation endpoint itself touches.
Know when Truebooker gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated remote enumeration gives AV:N/AC:L/PR:N/UI:N and C:L for PII exposure; I:L added because attackers can invalidate customers' confirmation links, unlike the vendor's I:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
2DescriptionCVE.org
The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as invalidate the customer's own confirmation link.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Truebooker
View allAccount takeover in TrueBooker WordPress plugin before 1.2.4 enables unauthenticated attackers to reset any user’s passw
The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL
Privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin through version 1.2.3 lets unau
Unauthenticated privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin versions 1.2.6
Unauthenticated SQL injection in the TrueBooker (truebooker-appointment-booking) WordPress plugin by themetechmount affe
Missing authorization checks in the TrueBooker WordPress plugin before 1.3.0 allow unauthenticated remote attackers to c
Unauthenticated attackers can create TrueBooker bookings at attacker-chosen prices and attach them to arbitrary customer
TrueBooker, a WordPress plugin, lets unauthenticated remote attackers rewrite its entire stored configuration because on
Unauthenticated broken access control in the TrueBooker WordPress appointment-booking plugin (versions ≤ 1.1.9 by ThemeT
The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could a
Unauthenticated settings modification in the TrueBooker appointment-booking WordPress plugin (versions 1.2.9 and earlier
TrueBooker appointment booking plugin through version 1.1.5 fails to enforce proper authorization controls, allowing una
Exploit-DB