The TrueBooker WordPress plugin lacks proper authorization checks in several AJAX actions and fails to validate the service price on the server side. This flaw allows any internet user, even without an account, to create bookings with a price of their choosing and associate those bookings with arbitrary customer accounts. The result is the possibility of fraudulent transactions and financial loss, as payments could be manipulated at will.

The vulnerability affects the TrueBooker WordPress plugin versions between 1.1.9 and 1.2.9. Users of these plugin releases are at risk.

With a CVSS score of 5.3, the vulnerability is considered medium in severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. Because the plugin’s AJAX endpoints permit unauthenticated access, an attacker can exploit the flaw by sending crafted requests from any host. No additional privileges are required, making exploitation straightforward for anyone who can reach the site’s AJAX interface.