The vulnerability is a missing authorization flaw that allows an attacker to bypass access control restrictions within the TrueBooker appointment booking plugin. This broken access control can enable a non‑privileged user to view or modify data that should be protected, compromising the confidentiality and integrity of booking information. The weakness is classified as CWE‑862, indicating a missing permission check.

The affected product is the TrueBooker plugin developed by themetechmount. Versions from the earliest available release through and including 1.1.5 are vulnerable. Any site running this plugin within that version range is at risk.

The CVSS score of 5.3 places the vulnerability in the medium severity range, and the EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in CISA’s KEV catalog, indicating it has not been observed in the wild or is not known to be actively exploited. The likely attack vector is through the web interface of the plugin, where an unauthenticated or low‑privilege user could request protected resources, but this inference is based on the description’s mention of incorrectly configured security levels. The attacker would need to locate and target the vulnerable endpoints.