CVE-2026-18779 in TrueBooker Plugin
Summary
by MITRE • 08/19/2026
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in the TrueBooker WordPress plugin prior to version 1.2.7 represents a critical failure in access control mechanisms within the application's administrative interface components exposed via AJAX endpoints. This flaw stems from an insufficient verification of user privileges before executing state-changing operations, specifically targeting the deletion functionality for appointment records. In secure web applications, any action that modifies data or affects system integrity must be protected by robust authorization checks to ensure that only authenticated users with appropriate roles and capabilities can perform such actions. The absence of these checks in this specific AJAX handler allows external actors to bypass standard authentication protocols entirely, treating sensitive administrative functions as publicly accessible resources.
From a technical perspective, the core issue lies in the lack of capability verification within the PHP code handling the delete request. Typically, WordPress plugins utilize nonces and current_user_can checks to validate that the requester is both authenticated and possesses the necessary permissions, such as administrator or editor roles. In this case, the endpoint fails to enforce these constraints, effectively leaving a direct path for unauthenticated interaction with backend database operations. This architectural oversight transforms what should be an internal management tool into an externally exploitable vector, allowing any internet user to send crafted HTTP requests that trigger the deletion logic without providing valid credentials or session tokens.
The operational impact of this vulnerability is severe due to its potential for data integrity compromise and service disruption. An attacker can systematically delete arbitrary appointment records, which inherently includes associated booking items and payment records stored in linked database tables. This results in significant business continuity issues for organizations relying on the plugin for scheduling services, as customer appointments are erased without consent or audit trails. Furthermore, the deletion of financial transaction data related to bookings creates discrepancies in accounting systems and can lead to loss of revenue tracking capabilities. The ability to remove records at will also facilitates potential cover-ups for other malicious activities if combined with additional vulnerabilities, although this specific flaw primarily targets availability and data integrity rather than confidentiality or direct code execution.
This vulnerability aligns closely with CWE-284, which describes Improper Access Control, specifically highlighting the failure to enforce proper authorization checks before allowing access to sensitive functions. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, although in this instance, it is notable that no valid account is required at all due to the complete absence of authentication requirements for certain administrative actions. This classification underscores the severity of misconfigurations or coding errors that expose privileged endpoints to public access. The incident serves as a reminder that AJAX handlers must be treated with the same security rigor as traditional form submissions, ensuring that every state-changing request is validated against user roles and permissions before execution.
To mitigate this risk, immediate action should be taken by updating the TrueBooker plugin to version 1.2.7 or later, where these authorization checks have been implemented correctly. Administrators of sites running older versions must apply a temporary workaround if an update cannot be deployed immediately, such as restricting access to WordPress admin-ajax.php via web server configuration rules like .htaccess files for specific action hooks associated with the plugin. Additionally, implementing Web Application Firewalls can help detect and block anomalous patterns of deletion requests originating from unauthenticated sources. Regular security audits and code reviews focusing on authorization logic in AJAX endpoints are essential preventive measures to ensure that future updates do not reintroduce similar access control failures.