CVE-2026-18778 Overview
CVE-2026-18778 is an information disclosure vulnerability in the TrueBooker WordPress plugin versions prior to 1.2.7. The plugin lacks proper authorization checks on several AJAX actions. Unauthenticated attackers can invoke these endpoints over the network to retrieve personal information of customers who booked appointments. Exposed data includes customer name, email address, phone number, and postal address. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated remote attackers can harvest customer personally identifiable information (PII) from any WordPress site running a vulnerable TrueBooker plugin version.
Affected Products
- TrueBooker WordPress plugin versions prior to 1.2.7
- WordPress sites with the vulnerable plugin activated
- Booking workflows exposing customer records via AJAX endpoints
Discovery Timeline
- 2026-08-19 - CVE-2026-18778 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-18778
Vulnerability Analysis
The TrueBooker plugin registers AJAX actions used to manage appointment bookings. Several of these actions do not verify the caller's identity or capabilities before returning booking records. An attacker sends crafted requests to wp-admin/admin-ajax.php and receives customer data in the response. No authentication, user interaction, or elevated privileges are required. The vulnerability exposes confidentiality only; integrity and availability are unaffected. Data at risk includes full name, email address, phone number, and postal address, all of which are usable for phishing, identity theft, and targeted social engineering. The EPSS probability score is 0.251% (percentile 16.819) as of 2026-08-21, indicating low observed exploitation likelihood at this time.
Root Cause
The plugin's AJAX handlers omit both capability checks (current_user_can()) and nonce verification (check_ajax_referer()). WordPress exposes AJAX actions registered with the wp_ajax_nopriv_ prefix to unauthenticated visitors. When such handlers return customer records without authorization gating, any anonymous caller can retrieve the underlying data.
Attack Vector
Exploitation occurs over the network. An attacker issues HTTP POST or GET requests to the WordPress AJAX endpoint, specifies the vulnerable plugin action, and iterates through booking identifiers to enumerate stored records. Because the endpoints respond directly with structured customer data, mass extraction can be automated with simple scripting.
// No verified proof-of-concept code is publicly available.
// Refer to the WPScan advisory for technical details:
// https://wpscan.com/vulnerability/0a9b6706-ff3a-4a41-b85c-fce696471217/
Detection Methods for CVE-2026-18778
Indicators of Compromise
- Unauthenticated POST or GET requests to /wp-admin/admin-ajax.php referencing TrueBooker action parameters.
- Sequential or high-volume AJAX requests from a single IP enumerating booking identifiers.
- HTTP responses from admin-ajax.php containing customer PII fields such as email, phone, or postal address.
Detection Strategies
- Inspect web server access logs for anonymous requests to admin-ajax.php with TrueBooker-specific action names.
- Alert on response payloads from admin-ajax.php exceeding baseline size, which may indicate bulk record disclosure.
- Correlate unauthenticated AJAX activity with absence of a valid WordPress session cookie.
Monitoring Recommendations
- Deploy a web application firewall (WAF) rule to log and rate-limit unauthenticated calls to TrueBooker AJAX actions.
- Enable WordPress audit logging to capture plugin AJAX invocations along with source IP and user agent.
- Review outbound data flows for unusual scraping patterns targeting booking-related endpoints.
How to Mitigate CVE-2026-18778
Immediate Actions Required
- Update the TrueBooker plugin to version 1.2.7 or later on all WordPress installations.
- Audit existing bookings and notify affected customers if disclosure is suspected under applicable privacy regulations.
- Rotate any credentials or tokens that may have been exposed through booking metadata.
Patch Information
The vendor addressed the issue in TrueBooker version 1.2.7 by adding proper authorization checks to the affected AJAX handlers. Refer to the WPScan Vulnerability Report for advisory details and remediation guidance.
Workarounds
- Deactivate the TrueBooker plugin until the patched version is installed if immediate updates are not possible.
- Restrict access to wp-admin/admin-ajax.php for unauthenticated clients using WAF policies where feasible.
- Apply IP allowlisting to the WordPress admin surface on sites that do not require public booking access.
# Update the TrueBooker plugin via WP-CLI
wp plugin update truebooker --version=1.2.7
wp plugin list --name=truebooker --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
