EUVD-2026-104105
GHSA-6cwc-727q-r97h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running TrueBooker < 1.3.0
-
ExploitSend crafted request to unprotected endpoint
-
ExecutionBypass missing authorisation check
-
ImpactCreate or modify booking services and prices
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond having the TrueBooker WordPress plugin installed at a version before 1.3.0 - exploitation is remote and unauthenticated (PR:N/UI:N/AC:L) against default configurations, requiring no credentials, user interaction, or non-default settings. The only limiting factors are deployment of this specific plugin and version; impact is restricted to creating/modifying booking services, categories, and prices (integrity), with no data exposure or service disruption. |
| Impact | This is a moderate-severity broken access control flaw with mixed risk signals. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated, remote, low-complexity exploitation against the TrueBooker WordPress plugin, and public exploit code exists (reported by WPScan), both of which raise practical risk. However, impact is bounded: the vector scores C:N/I:L/A:N, meaning only limited integrity impact (attackers can create/modify booking services, categories, and prices) with no confidentiality or availability loss. It is NOT listed in CISA KEV, so there is no confirmed active exploitation, and no EPSS score was provided to gauge exploitation probability. The net picture is a high-exposure but low-impact issue: trivially reachable and useful for data tampering or commercial manipulation (e.g., altering prices), but not a system-compromise vector. Treat as a prompt-patch item for affected sites rather than an emergency. Note a data-quality concern: the input 'Information Disclosure' tag conflicts with the vector (C:N, I:L), as this is an integrity/authorization flaw, not disclosure. |
| Exploit ScenarioDerived | An unauthenticated attacker sends crafted HTTP requests directly to the plugin's unprotected booking endpoints and creates or modifies booking services, categories, and their prices without logging in. Publicly available exploit code (WPScan) lowers the barrier to doing this at scale, enabling price manipulation or corruption of a site's booking catalog. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Missing authorization checks in the TrueBooker WordPress plugin before 1.3.0 allow unauthenticated remote attackers to create and modify booking services and categories, including their prices. Publicly available exploit code exists, and the assessed CVSS vector indicates integrity-only impact (C:N/I:L/A:N) with no confidentiality or availability effect. This is a moderate-severity broken access control issue requiring only that the vulnerable plugin version be deployed.
RemediationAI
Vendor-released patch: upgrade TrueBooker to 1.3.0 or later, the first version outside the stated affected range; consult the WPScan advisory at https://wpscan.com/vulnerability/d90ad3f4-4d58-43bc-8f17-0f6b8dfdde4f/ for confirmation. If immediate upgrade is not possible, deactivate the plugin until patched; this removes booking functionality but eliminates exposure. If booking must remain online, add a virtual patch or WAF rule that blocks unauthenticated requests to TrueBooker service and category create or update actions while allowing legitimate public booking views, understanding that overly broad rules can break normal booking flows and administrative edits. After patching, review services, categories, and prices for unauthorized changes and restore from known-good data if needed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TrueBooker is a WordPress booking plugin. The CPE cpe:2.3:a:unknown:truebooker:*:*:*:*:*:*:*:* records the product under an unknown vendor and a wildcard version, so the authoritative affected range comes from the advisory: all versions before 1.3.0. The root cause is absent authorization or capability checks on some booking-service and category functions, a broken access control class of flaw (CWE not supplied in the input). Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, exploitation is remote and unauthenticated against default configurations; no user interaction or special settings are required beyond plugin deployment. The source tag mentions information disclosure, but the assessed vector confines impact to integrity: attackers can alter services, categories, and prices, not read sensitive data or disrupt availability. The WPScan reference is marked as an exploit.
Know when Truebooker gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Missing authorisation check allows unauthenticated remote writes to booking data (PR:N, AV:N, AC:L); impact is limited integrity modification only, so I:L with C:N and A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
2DescriptionCVE.org
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Truebooker
View allAccount takeover in TrueBooker WordPress plugin before 1.2.4 enables unauthenticated attackers to reset any user’s passw
The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL
Privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin through version 1.2.3 lets unau
Unauthenticated privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin versions 1.2.6
Unauthenticated SQL injection in the TrueBooker (truebooker-appointment-booking) WordPress plugin by themetechmount affe
TrueBooker, a WordPress booking/appointment plugin, renders a booking confirmation summary without verifying that the re
Unauthenticated attackers can create TrueBooker bookings at attacker-chosen prices and attach them to arbitrary customer
TrueBooker, a WordPress plugin, lets unauthenticated remote attackers rewrite its entire stored configuration because on
Unauthenticated broken access control in the TrueBooker WordPress appointment-booking plugin (versions ≤ 1.1.9 by ThemeT
The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could a
Unauthenticated settings modification in the TrueBooker appointment-booking WordPress plugin (versions 1.2.9 and earlier
TrueBooker appointment booking plugin through version 1.1.5 fails to enforce proper authorization controls, allowing una
Exploit-DB