EUVD-2026-93042
GHSA-r5jp-2p9p-7ppp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running TrueBooker ≤1.2.9
-
DeliverySend unauthenticated request to settings endpoint
-
ExploitBypass missing authorization check
-
ExecutionModify plugin configuration
-
ImpactDisrupt booking functionality or data integrity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires only that the target WordPress site have the TrueBooker (truebooker-appointment-booking) plugin by themetechmount installed and active at version 1.2.9 or earlier, reachable over the network. No authentication, no user interaction, and no non-default configuration is needed - the missing authorization check (CWE-862) is exploitable against default installs. The primary limiting factor is deployment scope: only sites running this specific plugin at a vulnerable version are affected, and impact is confined to settings modification (integrity) and possible availability disruption rather than data disclosure or code execution. |
| Impact | This is a CWE-862 Missing Authorization flaw rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N, meaning it is remotely and unauthenticated-exploitable at low complexity with no user interaction - a genuinely low-friction attack surface. However, the impact is deliberately scoped as C:N/I:L/A:L: an attacker can alter plugin settings (integrity) and potentially degrade availability, but cannot read confidential data, and there is no indication of RCE or full site takeover from this issue alone. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active exploitation or mass scanning at this time; the low partial impact also makes this a lower real-world priority than the 'unauthenticated' label might first suggest. Net: real but moderate risk - easy to trigger, limited damage. The signals are internally consistent (network vector matches an 'unauthenticated settings change' in a WordPress plugin), with no conflicts to flag beyond the absence of exploitation-probability data. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a vulnerable TrueBooker endpoint that fails to verify authorization, allowing them to modify plugin configuration settings on the target WordPress site. Because no login, user interaction, or special timing is required (AV:N/AC:L/PR:N/UI:N), this can be automated across many sites. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated settings modification in the TrueBooker appointment-booking WordPress plugin (versions 1.2.9 and earlier) lets remote attackers alter plugin configuration without logging in, rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N, meaning no privileges, no user interaction, and low attack complexity are required against default installs. The flaw is a CWE-862 missing authorization condition that affects integrity (limited) and availability (limited) but not confidentiality, so the practical outcome is tampered or degraded booking/settings behaviour rather than data theft or code execution. Exposure is bounded by deployment scope - only WordPress sites running this specific ThemeTechMount plugin at a vulnerable version are at risk - and no public exploit code or confirmed active exploitation was identified at time of analysis; as of the Patchstack report (EUVD-2026-93042) no fixed version had been published.
RemediationAI
No vendor-released patch was identified at time of analysis for CVE-2026-39798; the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/truebooker-appointment-booking/vulnerability/wordpress-truebooker-plugin-1-2-9-settings-change-vulnerability) is the tracking reference to monitor for a fixed TrueBooker release, and administrators should also watch the WordPress.org plugin page and ThemeTechMount's site for a version newer than 1.2.9. Until a fix ships, the most effective control is to deactivate and remove the plugin if appointment booking is not actively in use - the trade-off being loss of that functionality - since a dormant plugin still exposes the vulnerable handler. If the plugin must stay live, block or challenge anonymous POSTs to the plugin's settings endpoints at the edge: add WAF/reverse-proxy rules denying unauthenticated requests to the truebooker action names on admin-ajax.php and to the plugin's REST namespace, and restrict /wp-admin/admin-ajax.php or the plugin routes to trusted IP ranges where operationally possible, accepting that legitimate front-end booking flows that rely on the same path may break or need allowlisting. Complement this with filesystem monitoring or a settings-change audit hook on the affected option keys to detect tampering, keep offsite backups of the WordPress database so altered settings can be restored, and re-check for an upstream patch frequently given the low exploitation friction of the issue.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TrueBooker is a WordPress appointment/booking plugin distributed by ThemeTechMount (CPE cpe:2.3:a:themetechmount:truebooker:*:*:*:*:*:*:*:*), and like most WordPress plugins it exposes configuration operations through AJAX handlers (admin-ajax.php) or REST routes registered with add_action/add_rest_route. CWE-862 (Missing Authorization) describes the root cause class here: the settings-changing handler performs its update without verifying that the caller holds a sufficient capability - the canonical WordPress pattern being a missing current_user_can('manage_options') check (and, for state-changing actions, absent nonce validation), which turns a privileged administrative function into one any anonymous HTTP client can invoke. This is distinct from a CSRF or injection bug: no malformed input or victim interaction is needed, only a reachable request to the insufficiently guarded settings endpoint. Because the CVSS vector is PR:N/UI:N/AC:L, the missing check is present in the default plugin configuration and no compensating default setting reduces the exposed surface.
Know when Truebooker gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Unauthenticated remote settings change over HTTP gives AV:N/AC:L/PR:N/UI:N; limited to config modification so I:L/A:L and C:N, no scope change.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Truebooker
View allAccount takeover in TrueBooker WordPress plugin before 1.2.4 enables unauthenticated attackers to reset any user’s passw
The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL
Unauthenticated privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin versions 1.2.6
Privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin through version 1.2.3 lets unau
Unauthenticated SQL injection in the TrueBooker (truebooker-appointment-booking) WordPress plugin by themetechmount affe
Unauthenticated broken access control in the TrueBooker WordPress appointment-booking plugin (versions ≤ 1.1.9 by ThemeT
The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could a
TrueBooker appointment booking plugin through version 1.1.5 fails to enforce proper authorization controls, allowing una
Cross-Site Request Forgery (CSRF) vulnerability in themetechmount TrueBooker allows Cross Site Request Forgery.0.7. Rate
Exploit-DB