CVE-2026-1797: Truebooker WordPress Information Disclosure

CVE-2026-1797 Overview

The Appointment Booking and Scheduler Plugin – Truebooker plugin for WordPress contains a Sensitive Information Exposure vulnerability affecting all versions up to and including 1.1.4. The vulnerability exists in the plugin's views PHP files, which can be directly accessed by unauthenticated attackers to view potentially sensitive information. This Missing Authorization flaw (CWE-862) allows malicious actors to bypass intended access controls and retrieve data that should be protected from unauthorized access.

Critical Impact

Unauthenticated attackers can directly access PHP view files to extract sensitive information from WordPress sites using the Truebooker appointment booking plugin, potentially exposing user data and appointment details.

Affected Products

• Truebooker Appointment Booking and Scheduler Plugin for WordPress version 1.1.4 and earlier
• Truebooker Appointment Booking and Scheduler Plugin for WordPress version 1.1.2
• All prior versions of the Truebooker WordPress plugin

Discovery Timeline

• 2026-03-31 - CVE CVE-2026-1797 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-1797

Vulnerability Analysis

This vulnerability stems from Missing Authorization (CWE-862) in the Truebooker WordPress plugin. The plugin fails to implement proper access control checks on its PHP view files, allowing direct file access without authentication. When attackers navigate directly to view files such as truebooker-user.php, they can retrieve information that the plugin's frontend would normally protect through application-level authentication and authorization mechanisms.

The network-based attack vector allows exploitation from remote locations without requiring any privileges or user interaction. While the vulnerability only impacts confidentiality with no effect on integrity or availability, the exposed information could include user appointment data, configuration details, or other sensitive plugin-related information.

Root Cause

The root cause is the absence of authorization checks within the PHP view files located in the plugin's main/views/ directory. WordPress plugins should validate user permissions before rendering sensitive content, but the Truebooker plugin directly outputs view content without verifying that the request originates from an authenticated and authorized user session. This oversight allows direct URL access to bypass the application's intended security boundaries.

Attack Vector

Exploitation requires no authentication and can be performed over the network. An attacker simply navigates to the vulnerable PHP view files directly by crafting URLs that point to the exposed files within the plugin directory structure. For example, accessing /wp-content/plugins/truebooker-appointment-booking/main/views/truebooker-user.php directly could reveal sensitive user or appointment information that should only be accessible through the authenticated WordPress admin interface.

The vulnerability is straightforward to exploit—an attacker only needs to know or discover the file paths within the plugin structure. The plugin code can be reviewed via the WordPress Plugin Code View to understand which files may be vulnerable.

Detection Methods for CVE-2026-1797

Indicators of Compromise

• Direct HTTP requests to /wp-content/plugins/truebooker-appointment-booking/main/views/ directory paths from external IP addresses
• Unusual access patterns to PHP files within the Truebooker plugin views directory without corresponding authenticated sessions
• Web server logs showing 200 OK responses for direct access to plugin view files from unauthenticated users
• Repeated enumeration attempts targeting various files within the plugin directory structure

Detection Strategies

• Configure web application firewall (WAF) rules to block direct access to PHP files within the truebooker-appointment-booking/main/views/ directory
• Enable detailed access logging on the WordPress server to capture all requests to plugin directories
• Implement intrusion detection system (IDS) signatures to alert on direct access attempts to sensitive plugin files
• Use WordPress security plugins to monitor and alert on suspicious file access patterns

Monitoring Recommendations

• Regularly audit web server access logs for direct requests to plugin view files that bypass the WordPress application layer
• Monitor for reconnaissance activity targeting WordPress plugin directory structures
• Set up automated alerts for any 200 OK responses to direct PHP file requests within plugin directories
• Review plugin file permissions periodically to ensure view files are not publicly accessible

How to Mitigate CVE-2026-1797

Immediate Actions Required

• Update the Truebooker Appointment Booking and Scheduler Plugin to a patched version as soon as one becomes available
• Restrict direct access to PHP files within the plugin's views directory using web server configuration
• Review WordPress site for any signs of information exposure or unauthorized data access
• Consider temporarily disabling the Truebooker plugin if sensitive data is at risk until a patch is available

Patch Information

No official patch has been confirmed at the time of this advisory. Site administrators should monitor the Wordfence Vulnerability Report and the official WordPress plugin repository for updates. Once a patched version is released, immediately update to the latest version of the Truebooker plugin.

Workarounds

• Add .htaccess rules to deny direct access to PHP files within the Truebooker views directory
• Configure web server (Apache/Nginx) to block direct access to the main/views/ directory within the plugin
• Implement WordPress capability checks at the application level if custom development is an option
• Consider using a Web Application Firewall (WAF) to block suspicious direct file access requests

# Apache .htaccess configuration to block direct access to Truebooker view files
# Add to /wp-content/plugins/truebooker-appointment-booking/main/views/.htaccess

<Files *.php>
    Order Deny,Allow
    Deny from all
</Files>