The TrueBooker WordPress plugin version 1.1.9 through 1.2.9 fails to verify that a requester owns a booking before rendering the confirmation summary. This IDOR permits an unauthenticated user to supply a refappbkd value, enumerate existing bookings, retrieve customer personally identifiable information, and invalidate the legitimate confirmation link for that user. No code execution or privilege escalation is possible, but the breach of confidentiality could erode user trust.

WordPress sites that run the TrueBooker Appointment Booking plugin from versions 1.1.9 to 1.2.9 are affected.

The CVSS score of 5.3 reflects medium severity; the EPSS score is not available and the flaw is not listed in the CISA KEV catalog. Attackers can exploit the vulnerability over the open internet with no authentication, simply by guessing or iterating the refappbkd parameter to enumerate bookings and obtain sensitive customer data.