The vulnerability allows unauthenticated users to directly access view PHP files within the Truebooker plugin. These files can contain sensitive booking and user information, making it possible to read data that should be protected. The weakness is classified as Missing Authorization, as the plugin fails to enforce proper access controls on these files.

All installations of the Truebooker – Appointment Booking and Scheduler System with versions up to and including 1.1.4 are impacted. The issue stems from the views directory within the plugin, where PHP files are exposed to web access. Users of older WordPress sites running this plugin version should review their configurations for potential data exposure.

The CVSS score of 5.3 indicates a medium severity vulnerability that does not involve code execution or privilege escalation, but it carries confidentiality risk. Exploitation is straightforward: attackers simply request the exposed PHP file URLs, which triggers the disclosure. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Overall, this vulnerability is easy to exploit and should be mitigated promptly.