The TrueBooker WordPress plugin suffers from a missing authorization flaw that allows attackers to bypass the configured security levels and interact with sensitive admin functionality. The flaw can enable unauthorized users to access or modify booking data, schedule appointments, or perform privileged operations normally reserved for administrators. This weakness is classified as CWE‑862 and results in unauthorized access, potentially compromising confidentiality, integrity, and availability of booking information.

The vulnerability affects the WordPress TrueBooker appointment‑booking plugin from unidentified versions through 1.1.0. Any WordPress site employing TrueBooker 1.1.0 or earlier is potentially exposed.

The CVSS score is 5.3, indicating moderate severity, and the EPSS score is less than 1%, suggesting low to very low projected exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers could exploit the flaw by hitting exposed endpoints of the plugin without proper authorization checks; the attack requires only knowledge of the plugin’s administration paths and does not depend on user credentials. Given the lack of publicly available exploitation code and the low EPSS, the risk remains moderate but should not be ignored.