TrueBooker EUVD-2026-36856

No special conditions - remote unauthenticated exploitation against default installations of any WordPress site running the TrueBooker Appointment Booking plugin at version 1.1.9 or earlier; the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and low attack complexity. The only limiting factors are that the target must have the plugin installed and active and must be reachable over HTTP/HTTPS, and the attacker must know or guess the vulnerable endpoint path (trivial once the Patchstack advisory describes it). No availability impact is expected (A:N), so denial-of-service is not part of the realistic outcome.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) describes a remote, low-complexity, unauthenticated issue with high confidentiality and integrity impact and no availability impact, which is consistent with a missing-authorization flaw exposing booking records and write operations. Real-world risk is elevated because WordPress plugins are routinely mass-scanned by commodity tooling once a Patchstack advisory is published, even when no POC is included. However, EPSS data was not supplied, the vulnerability is not in CISA KEV, and no POC reference is included in the intelligence - so widespread exploitation is plausible but not confirmed. The relatively narrow install base of a niche commercial plugin likely keeps this as a targeted rather than internet-scale threat for now.

An unauthenticated attacker discovers a WordPress site running TrueBooker ≤ 1.1.9, enumerates the plugin's AJAX or REST endpoints, and issues crafted HTTP requests directly to the vulnerable handler to read confidential booking records (customer names, contact details, appointment times) and modify or cancel bookings. Because no authentication or user interaction is required and the attack complexity is low, the entire flow can be automated and combined with mass-scanning of WordPress installs.