Description

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-19T06:17:38.250Z",
  "pubdate": "2026-08-19T06:17:38.250Z",
  "executiveSummary": "An authorization bypass vulnerability exists within the TrueBooker WordPress plugin prior to version 1.2.7. The flaw resides in the handling of specific AJAX actions exposed by the plugin, which fail to enforce proper access control and capability checks.\nThis security deficiency allows unauthenticated remote attackers to interact directly with vulnerable backend AJAX endpoints over the network. Consequently, unauthorized actors can manipulate appointment statuses within the database and trigger arbitrary notification emails destined for affected customers, leading to potential service disruption, social engineering opportunities, and information exposure.\nThe risk implications are moderate to high, depending on the operational reliance on the appointment booking system. Successful exploitation requires no prior authentication, privileges, or user interaction, lowering the barrier to entry for malicious actors targeting exposed WordPress installations running vulnerable versions of the TrueBooker product.",
  "technicalDetails": "The root cause of the vulnerability stems from missing or inadequate authorization checks within the AJAX action handler of the TrueBooker plugin. In WordPress architecture, AJAX endpoints exposed to unauthenticated users via admin-ajax.php must strictly validate user sessions, nonces, and user capabilities to ensure that only authorized entities can perform state-changing operations.\nThe vulnerable component consists of the plugin's internal AJAX request processing logic, specifically the function responsible for updating appointment records. Because the code fails to verify whether the incoming request originates from a privileged user—such as an administrator or the appointment owner—any unauthenticated client can invoke the functionality directly.\nThe attack flow proceeds as follows: an unauthenticated attacker crafts an HTTP request targeting the WordPress AJAX interface, supplying the specific action parameter associated with the TrueBooker appointment management routine. Along with the action parameter, the attacker includes manipulated data within the request payload, such as arbitrary appointment identifiers and the desired target status.\nUpon receiving the request, the vulnerable plugin code processes the input without verifying authorization tokens or user roles. The backend database executes the status modification query against the specified appointment record. Furthermore, the application logic subsequently triggers automated notification emails directed at the affected customers associated with the manipulated appointments.\nThe network exposure is public-facing, as WordPress AJAX endpoints are accessible over standard HTTP/HTTPS protocols to any internet-enabled client. The authentication and privilege requirements are entirely absent, permitting unauthenticated execution. Post-exploitation impact includes unauthorized alteration of booking states, denial of service via corrupted appointment schedules, and reputational damage through the dissemination of fraudulent notification emails generated legitimately by the compromised application."
}