Description

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-19T06:17:38.683Z",
  "pubdate": "2026-08-19T06:17:38.683Z",
  "executiveSummary": "An authorization bypass vulnerability exists within the TrueBooker WordPress plugin prior to version 1.2.7. The flaw resides in an improperly secured AJAX action handler, which completely omits authentication and privilege verification checks.\nThe primary impact of this vulnerability is the unauthorized destruction of data. Specifically, malicious actors can exploit this flaw to delete arbitrary appointment records stored within the WordPress database, along with their associated booking items and payment records.\nThe affected system is the TrueBooker WordPress plugin for versions below 1.2.7. This introduces significant risk implications, including operational disruption, data integrity loss, and potential financial tracking obfuscation for site administrators utilizing the booking platform.\nRegarding attacker capabilities, unauthenticated remote adversaries can directly trigger the vulnerable AJAX endpoint over the network without requiring any prior user interaction or valid credentials. Exploitation requirements are minimal, needing only the ability to craft HTTP requests targeting the exposed AJAX action to execute the deletion routine successfully.",
  "technicalDetails": "The root cause of the vulnerability stems from missing authorization controls within a specific AJAX action handler implemented by the TrueBooker WordPress plugin. In WordPress plugin development, AJAX endpoints must explicitly validate user sessions, nonces, and capabilities (such as current_user_can) to ensure that only authorized entities can perform sensitive database operations. In versions prior to 1.2.7 of TrueBooker, the relevant AJAX action fails to implement these necessary access control checks.\nThe vulnerable component is the server-side AJAX routing and processing logic handling appointment deletions within the TrueBooker plugin codebase. Because the endpoint lacks authentication and privilege requirements, it operates with complete exposure over the network, allowing any unauthenticated remote user to interact directly with the backend functionality.\nThe exploitation method relies on sending crafted HTTP requests to the WordPress AJAX endpoint (admin-ajax.php) specifying the vulnerable action parameter associated with the TrueBooker plugin. The attack flow proceeds as follows: First, the unauthenticated adversary identifies or targets the exposed AJAX action handler responsible for processing appointment removals. Second, the attacker constructs an HTTP POST or GET request directed at the WordPress site, supplying the necessary parameters—such as specific appointment identifiers—required by the deletion function. Third, because the underlying code processes the request without validating whether the caller possesses administrative or booking-manager privileges, the application proceeds to execute the database deletion queries. Finally, the targeted appointment records, along with their associated booking items and payment records, are permanently removed from the database.\nThe post-exploitation impact includes severe data loss and denial of service for the booking functionality. By systematically iterating through appointment identifiers, an attacker could purge all stored bookings and transactional payment records, severely disrupting business operations and compromising the integrity of the WordPress site's database."
}