The TrueBooker WordPress plugin before version 1.2.7 contains an unauthenticated AJAX endpoint that allows an attacker to change the status of any appointment and trigger notification emails. This missing authorization check gives an attacker the ability to modify appointment data arbitrarily, potentially canceling, rescheduling or confirming appointments without permission. Because the endpoint also sends emails, an attacker could send misleading notifications to customers, leading to confusion or fraud.

Affected systems are installations of the TrueBooker appointment booking plugin for WordPress with versions less than 1.2.7. The vendor is listed as Unknown:TrueBooker. All users running a vulnerable version of the plugin are at risk until they upgrade or mitigate the endpoint.

The CVSS score of 5.3 classifies the vulnerability as medium severity, and the EPSS score of less than 1% indicates a very low likelihood of being actively exploited at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only that the attacker can make an unauthenticated HTTP request to the update_appointment_status AJAX action, which is publicly reachable on the site. No special privileges or network access are required, making the attack vector straightforward for anyone on the Internet.