The TrueBooker WordPress plugin, versions before 1.3.0, contains a handler that does not verify user capabilities. The token required for this call is assigned to unauthenticated visitors, allowing any user to overwrite the entire plugin configuration. This can disable booking features, misconfigure scheduling settings, or introduce malicious defaults, thereby compromising the integrity of the booking system. The weakness is a lack of authorization checks, resulting in a moderate security concern as reflected by the CVSS score of 5.3.

WordPress sites using the TrueBooker Appointment Booking plugin version 1.1.9 through 1.2.9 are affected. The vulnerability applies to the admin_setting_setup_data API endpoint exposed by the plugin during initial configuration.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no currently known widespread exploitation. The likely attack vector is via HTTP requests to the setup endpoint, accessible to anyone without authentication. Because the token is issued to unauthenticated users, an attacker can overwrite configuration freely, but cannot execute code or gain system privileges.