TrueBooker CVE-2026-94231

No special conditions beyond having the TrueBooker WordPress plugin installed at a version before 1.3.0 - exploitation is remote and unauthenticated (PR:N/UI:N/AC:L) against default configurations, requiring no credentials, user interaction, or non-default settings. The only limiting factors are deployment of this specific plugin and version; impact is restricted to creating/modifying booking services, categories, and prices (integrity), with no data exposure or service disruption.

This is a moderate-severity broken access control flaw with mixed risk signals. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated, remote, low-complexity exploitation against the TrueBooker WordPress plugin, and public exploit code exists (reported by WPScan), both of which raise practical risk. However, impact is bounded: the vector scores C:N/I:L/A:N, meaning only limited integrity impact (attackers can create/modify booking services, categories, and prices) with no confidentiality or availability loss. It is NOT listed in CISA KEV, so there is no confirmed active exploitation, and no EPSS score was provided to gauge exploitation probability. The net picture is a high-exposure but low-impact issue: trivially reachable and useful for data tampering or commercial manipulation (e.g., altering prices), but not a system-compromise vector. Treat as a prompt-patch item for affected sites rather than an emergency. Note a data-quality concern: the input 'Information Disclosure' tag conflicts with the vector (C:N, I:L), as this is an integrity/authorization flaw, not disclosure.

An unauthenticated attacker sends crafted HTTP requests directly to the plugin's unprotected booking endpoints and creates or modifies booking services, categories, and their prices without logging in. Publicly available exploit code (WPScan) lowers the barrier to doing this at scale, enabling price manipulation or corruption of a site's booking catalog.