PHP EUVD-2026-17317

This vulnerability presents moderate real-world risk despite its moderate CVSS score of 5.3. The attack vector is network-based with low complexity and requires no privileges or user interaction, making exploitation trivially easy for any attacker. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated remote exploitation. The confidentiality impact is rated as low, reflecting disclosure of sensitive information that does not directly compromise system integrity or availability. However, the practical risk depends on what data is actually exposed in the view files-if they contain API keys, database connection strings, or user PII, the business impact could be significantly higher than the CVSS suggests. From an SSVC perspective, exploitation is uncomplicated and likely automatable via simple directory scanning and HTTP requests. This is a priority fix for any WordPress site running Truebooker, particularly those handling appointment booking data that may include customer contact information or payment details. The lack of authentication requirements is the key risk aggravator.

An attacker performs directory enumeration or uses common WordPress plugin path patterns to identify the Truebooker plugin installation on a target website. They then make HTTP requests directly to known view files (e.g., /wp-content/plugins/truebooker-appointment-booking/main/views/truebooker-user.php) without any authentication. The web server executes or displays the PHP file contents, exposing sensitive information such as database table structures, API endpoints, or user data processing logic. No specialized exploit code or tools are required-a simple web browser or curl command is sufficient to retrieve the information.