TrueBooker – Appointment Booking and Scheduler System: Sensitive information exposure
TrueBooker – Appointment Booking and Scheduler System is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller. The published affected range is <= 1.1.4.
- Component
- TrueBooker – Appointment Booking and Scheduler System
- Plugin slug
truebooker-appointment-booking- Affected
- <= 1.1.4
- Safe version
> 1.1.4- Published
- Mar 31, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Mar 31, 2026 and is one of 6 known issues for this plugin.
Patch or disable the affected component.
Update TrueBooker – Appointment Booking and Scheduler System to a release after 1.1.4, or disable and remove it until a fixed version is available.
Technical description
The Appointment Booking and Scheduler Plugin – Truebooker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 through views php files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed views php files via direct access.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N