CVE-2026-18779: TrueBooker WordPress Auth Bypass Flaw

CVE-2026-18779 Overview

CVE-2026-18779 affects the TrueBooker WordPress plugin in versions prior to 1.2.7. The plugin fails to enforce authorization checks on one of its AJAX actions. Unauthenticated attackers can invoke this action to delete arbitrary appointment records, along with their associated booking items and payment records.

The issue is classified as Missing Authorization [CWE-862]. Exploitation requires only network access to the target site and no user interaction. While the flaw does not permit code execution or data disclosure, it enables destruction of booking and payment data used by site operators.

Critical Impact
Unauthenticated deletion of appointment, booking, and payment records via an unprotected AJAX endpoint in TrueBooker before 1.2.7.

Affected Products

TrueBooker WordPress plugin versions before 1.2.7
WordPress sites using TrueBooker for appointment scheduling
Sites processing bookings and payments through the plugin

Discovery Timeline

2026-08-19 - CVE-2026-18779 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-18779

Vulnerability Analysis

The TrueBooker plugin exposes AJAX actions through the standard WordPress admin-ajax.php endpoint. One of these actions handles deletion of appointment records but does not verify the caller's identity, role, or intent. The handler processes the request and removes the targeted appointment along with related booking and payment rows.

The vulnerability sits in the plugin's request handling logic. Two protections that should exist are absent: a capability check via current_user_can() and a nonce verification via check_ajax_referer(). Without these controls, any HTTP client can trigger the deletion path.

Because the AJAX hook is registered on the wp_ajax_nopriv_ variant, unauthenticated visitors can invoke it. The impact is limited to integrity of booking data; the plugin does not leak content or crash the site.

Root Cause

The root cause is Missing Authorization [CWE-862] on an AJAX action that performs a destructive database operation. The handler trusts the request parameters and executes the deletion without confirming the requester holds administrative or scheduling privileges.

Attack Vector

An attacker sends a crafted POST request to admin-ajax.php specifying the vulnerable action and a target appointment identifier. Attackers can enumerate identifiers sequentially to remove multiple records. See the WPScan Vulnerability Report for advisory details.

Detection Methods for CVE-2026-18779

Indicators of Compromise

Unexpected disappearance of appointment, booking, or payment records in the TrueBooker database tables
POST requests to /wp-admin/admin-ajax.php from unauthenticated sources referencing TrueBooker AJAX actions
Sequential requests targeting incrementing appointment IDs within a short window

Detection Strategies

Review web server access logs for unauthenticated POST traffic to admin-ajax.php with TrueBooker action parameters
Audit database change logs for bulk DELETE statements against appointment, booking, and payment tables
Correlate customer complaints about missing bookings with server-side request timestamps

Monitoring Recommendations

Enable WordPress activity logging plugins to record record deletions and the associated request source
Forward web and application logs to a centralized SIEM for anomaly analysis
Alert on high-volume POST activity to admin-ajax.php from single IPs without an authenticated session cookie

How to Mitigate CVE-2026-18779

Immediate Actions Required

Update the TrueBooker WordPress plugin to version 1.2.7 or later
Back up the WordPress database before applying the update to preserve current booking data
Review recent appointment, booking, and payment records for unexplained deletions and restore from backup where needed

Patch Information

The vendor addressed CVE-2026-18779 in TrueBooker version 1.2.7 by adding proper authorization checks to the affected AJAX action. Site administrators should apply the update through the WordPress plugin management interface. Refer to the WPScan Vulnerability Report for advisory information.

Workarounds

Restrict access to /wp-admin/admin-ajax.php at the web application firewall to block unauthenticated requests referencing TrueBooker actions
Temporarily deactivate the TrueBooker plugin until the update to 1.2.7 can be applied
Enforce IP allowlisting on the WordPress admin path where operationally feasible

bash

# Example WAF rule: block unauthenticated POSTs to admin-ajax.php
# referencing TrueBooker deletion actions until the patch is applied
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1026187790,msg:'Block TrueBooker unauth AJAX'"
  SecRule ARGS:action "@rx (?i)truebooker.*delete" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"