A cross‑site request forgery vulnerability in the TrueBooker WordPress plugin allows an attacker to cause authenticated site users to execute unintended actions without their knowledge. By tricking a logged‑in user into visiting a crafted URL, an attacker can trigger booking‑related state changes or other privileged operations, directly impacting the integrity and reliability of the booking system.

The vulnerability applies to the TrueBooker plugin distributed by themetechmount for WordPress, affecting all versions up to and including 1.0.7. This plugin is typically integrated into WordPress sites that manage appointments and bookings.

The CVSS score of 4.3 indicates a moderate risk, and an EPSS score of less than 1% suggests that exploitation is unlikely but not impossible. The vulnerability is not currently listed in CISA KEV, implying it has not yet been observed in the wild. The likely attack vector involves a malicious link or image that a victim website administrator or regular user might click while authenticated, leading to credential‑leakage or accidental booking manipulation.