Description

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the personal information of customers who booked an appointment, including their name, email address, phone number and postal address.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-19T06:17:38.470Z",
  "pubdate": "2026-08-19T06:17:38.470Z",
  "executiveSummary": "The TrueBooker WordPress plugin before 1.2.7 suffers from an improper authorization vulnerability affecting specific AJAX actions. This security flaw allows unauthenticated remote attackers to bypass access controls and query sensitive endpoints designed to handle appointment data. Consequently, malicious actors can systematically harvest sensitive personally identifiable information (PII) belonging to customers who have scheduled appointments through the platform.\nThe exposed data records include full customer names, email addresses, telephone numbers, and postal addresses. This unauthorized disclosure poses severe privacy risks, exposing users to targeted phishing campaigns, social engineering, identity theft, and potential violations of data privacy regulations such as GDPR. Exploitation of this vulnerability requires no prior authentication, privileged access, or user interaction, as the vulnerable AJAX actions are exposed directly to the public web interface.\nThe root cause stems from missing or inadequate capability checks and nonce validation routines within the plugin's AJAX request handlers. Remediation requires updating the TrueBooker plugin to version 1.2.7 or later, where proper authorization mechanisms have been implemented to restrict access to authorized users only.",
  "technicalDetails": "The vulnerability resides within the backend AJAX action handlers implemented by the TrueBooker WordPress plugin. WordPress AJAX actions typically rely on specific hooks (e.g., wp_ajax_ and wp_ajax_nopriv_) to process asynchronous requests from the client side. In versions prior to 1.2.7, certain AJAX endpoints responsible for retrieving appointment and customer records fail to adequately verify the identity, session state, or cryptographic nonces of the incoming request.\nSpecifically, the affected component lacks proper authorization checks, such as verifying current_user_can() capabilities or validating security nonces via check_ajax_referer(). Because the endpoint improperly exposes functionality intended for administrative or authorized contexts to unauthenticated visitors via the wp_ajax_nopriv_ handler, any remote adversary can interact directly with the vulnerable AJAX controller.\nThe attack flow proceeds as follows: 1) The unauthenticated attacker identifies the exposed AJAX action endpoint associated with the TrueBooker plugin, typically interacting with the standard WordPress administrative endpoint wp-admin/admin-ajax.php. 2) The attacker crafts an HTTP GET or POST request specifying the vulnerable action parameter corresponding to the appointment retrieval functionality. 3) Lacking adequate access control enforcement, the backend PHP controller processes the request without validating whether the sender possesses administrative privileges or legitimate booking ownership. 4) The plugin queries the database and serializes the resulting appointment dataset containing sensitive PII, including customer names, email addresses, phone numbers, and postal addresses. 5) The server returns the payload in the HTTP response, typically formatted as JSON, exposing the harvested personal data directly to the unauthenticated client.\nThe attack surface is exposed entirely over the network via HTTP/HTTPS protocols without requiring any pre-existing user accounts, session tokens, or elevated privileges. Post-exploitation impact is characterized by the mass enumeration and exfiltration of customer data, facilitating downstream cyber threats including identity theft, credential stuffing, and spear-phishing."
}