CVE-2026-1797: Truebooker WordPress Information Disclosure

CVE-2026-1797 Overview

The Appointment Booking and Scheduler Plugin – Truebooker plugin for WordPress contains a Sensitive Information Exposure vulnerability affecting all versions up to and including 1.1.4. The vulnerability exists in the plugin's views PHP files, which can be directly accessed by unauthenticated attackers to view potentially sensitive information. This Missing Authorization flaw (CWE-862) allows malicious actors to bypass intended access controls and retrieve data that should be protected from unauthorized access.

Critical Impact
Unauthenticated attackers can directly access PHP view files to extract sensitive information from WordPress sites using the Truebooker appointment booking plugin, potentially exposing user data and appointment details.

Affected Products

Truebooker Appointment Booking and Scheduler Plugin for WordPress version 1.1.4 and earlier
Truebooker Appointment Booking and Scheduler Plugin for WordPress version 1.1.2
All prior versions of the Truebooker WordPress plugin

Discovery Timeline

2026-03-31 - CVE CVE-2026-1797 published to NVD
2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-1797

Vulnerability Analysis

This vulnerability stems from Missing Authorization (CWE-862) in the Truebooker WordPress plugin. The plugin fails to implement proper access control checks on its PHP view files, allowing direct file access without authentication. When attackers navigate directly to view files such as truebooker-user.php, they can retrieve information that the plugin's frontend would normally protect through application-level authentication and authorization mechanisms.

The network-based attack vector allows exploitation from remote locations without requiring any privileges or user interaction. While the vulnerability only impacts confidentiality with no effect on integrity or availability, the exposed information could include user appointment data, configuration details, or other sensitive plugin-related information.

Root Cause

The root cause is the absence of authorization checks within the PHP view files located in the plugin's main/views/ directory. WordPress plugins should validate user permissions before rendering sensitive content, but the Truebooker plugin directly outputs view content without verifying that the request originates from an authenticated and authorized user session. This oversight allows direct URL access to bypass the application's intended security boundaries.

Attack Vector

Exploitation requires no authentication and can be performed over the network. An attacker simply navigates to the vulnerable PHP view files directly by crafting URLs that point to the exposed files within the plugin directory structure. For example, accessing /wp-content/plugins/truebooker-appointment-booking/main/views/truebooker-user.php directly could reveal sensitive user or appointment information that should only be accessible through the authenticated WordPress admin interface.

The vulnerability is straightforward to exploit—an attacker only needs to know or discover the file paths within the plugin structure. The plugin code can be reviewed via the WordPress Plugin Code View to understand which files may be vulnerable.

Detection Methods for CVE-2026-1797

Indicators of Compromise

Direct HTTP requests to /wp-content/plugins/truebooker-appointment-booking/main/views/ directory paths from external IP addresses
Unusual access patterns to PHP files within the Truebooker plugin views directory without corresponding authenticated sessions
Web server logs showing 200 OK responses for direct access to plugin view files from unauthenticated users
Repeated enumeration attempts targeting various files within the plugin directory structure

Detection Strategies

Configure web application firewall (WAF) rules to block direct access to PHP files within the truebooker-appointment-booking/main/views/ directory
Enable detailed access logging on the WordPress server to capture all requests to plugin directories
Implement intrusion detection system (IDS) signatures to alert on direct access attempts to sensitive plugin files
Use WordPress security plugins to monitor and alert on suspicious file access patterns

Monitoring Recommendations

Regularly audit web server access logs for direct requests to plugin view files that bypass the WordPress application layer
Monitor for reconnaissance activity targeting WordPress plugin directory structures
Set up automated alerts for any 200 OK responses to direct PHP file requests within plugin directories
Review plugin file permissions periodically to ensure view files are not publicly accessible

How to Mitigate CVE-2026-1797

Immediate Actions Required

Update the Truebooker Appointment Booking and Scheduler Plugin to a patched version as soon as one becomes available
Restrict direct access to PHP files within the plugin's views directory using web server configuration
Review WordPress site for any signs of information exposure or unauthorized data access
Consider temporarily disabling the Truebooker plugin if sensitive data is at risk until a patch is available

Patch Information

No official patch has been confirmed at the time of this advisory. Site administrators should monitor the Wordfence Vulnerability Report and the official WordPress plugin repository for updates. Once a patched version is released, immediately update to the latest version of the Truebooker plugin.

Workarounds

Add .htaccess rules to deny direct access to PHP files within the Truebooker views directory
Configure web server (Apache/Nginx) to block direct access to the main/views/ directory within the plugin
Implement WordPress capability checks at the application level if custom development is an option
Consider using a Web Application Firewall (WAF) to block suspicious direct file access requests

bash

# Apache .htaccess configuration to block direct access to Truebooker view files
# Add to /wp-content/plugins/truebooker-appointment-booking/main/views/.htaccess

<Files *.php>
    Order Deny,Allow
    Deny from all
</Files>