The TrueBooker WordPress plugin lacks proper authorisation checks in its AJAX action update_appointment_booked. As a result, unauthenticated users can delete any appointment record together with its booking items and payment records. This flaw results in data loss and potential denial of service. The weakness is an Authority Bypass with Vulnerable Privileges (CWE-862).

TrueBooker plugin for WordPress, versions prior to 1.2.7. Any site running the vulnerable plugin is affected.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation at the time of assessment and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely an unauthenticated HTTP request to the update_appointment_booked endpoint, which can be performed by any internet user without needing to authenticate or have any special privileges.