This vulnerability arises from a missing authorization check in the WordPress TrueBooker appointment‑booking plugin. The flaw allows an attacker to execute privileged operations or access data that should be restricted, potentially manipulating bookings, retrieving personal information, or otherwise altering the state of the system. The weakness is classified as CWE‑862, indicating that authorization is improperly enforced, leading to unauthorized privilege escalation or leakage of confidential data.

WordPress sites that have installed the TrueBooker plugin from the vendor themetechmount. All releases up to and including version 1.1.5 are affected, while any version newer than 1.1.5 is assumed to contain the fix. Site owners must verify the plugin version and ensure they are not running an affected release.

Because the flaw permits actions without proper authentication, an attacker can exploit the web interface of the plugin, typically via HTTP requests to endpoints that assume a valid user session. No public exploit is documented and the EPSS score is currently unavailable, but the absence of a restriction makes the vulnerability potentially high impact. The vendor has not listed this issue in the CISA KEV catalog, indicating that it is not currently known to be exploited in the wild. Nonetheless, the lack of authorization results in a serious security risk for any site lacking additional controls.