TrueBooker EUVD-2026-104104

Requires the TrueBooker WordPress plugin at a version before 1.3.0 to be installed and active, with its booking AJAX actions reachable (the default state for the plugin's core functionality). No authentication, user interaction, or special configuration is needed (AV:N/AC:L/PR:N/UI:N) - exploitation works against default installations. The only real limiting factors are that the target site must run this specific plugin and version, and impact is confined to booking creation/price manipulation and account association rather than broader data access or code execution.

This is a medium-severity (CVSS 5.3) broken-access-control and business-logic flaw whose signals are internally consistent but modest. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N confirms remote, unauthenticated, low-complexity exploitation with no user interaction, which raises the practical ease of abuse. However, impact is limited to integrity (I:L) with no confidentiality (C:N) or availability (A:N) effect, so this is not a data-breach or RCE issue - it is a financial/data-integrity abuse (setting arbitrary booking prices and attaching bookings to arbitrary customer accounts). Public exploit code exists (WPScan), which lowers the barrier to opportunistic abuse, but there is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation - treat POC availability and active exploitation as distinct signals. Note a conflict: the input 'Information Disclosure' tag contradicts the CVSS vector's C:N (no confidentiality impact); the actual flaw is missing authorization plus server-side price-validation bypass, i.e. an integrity/business-logic issue, not disclosure. Net: a real but site-specific priority for operators running the affected plugin on commercial/booking sites, not a broad-fleet emergency.

An attacker, without any account or authentication, sends a crafted AJAX request to the TrueBooker plugin on a vulnerable WordPress site, supplying an arbitrary (e.g. near-zero) service price and a target customer account ID. Because the AJAX action lacks authorization checks and does not validate the price server-side, the booking is created at the attacker-chosen price and associated with the victim's account. Public exploit code is available (WPScan), making opportunistic abuse straightforward against default installations of the plugin.