CVE-2026-94229: TrueBooker WordPress Info Disclosure Flaw

CVE-2026-94229 Overview

CVE-2026-94229 is an Insecure Direct Object Reference (IDOR) vulnerability in the TrueBooker WordPress plugin before version 1.3.0. The plugin fails to verify that a requester owns a booking before rendering its confirmation summary. Unauthenticated attackers can enumerate booking identifiers to retrieve personal information of customers who booked appointments. Attackers can also invalidate a customer's own confirmation link through the same flaw. The issue is tracked under CWE-639 (Authorization Bypass Through User-Controlled Key).

Critical Impact
Unauthenticated attackers can harvest customer personal data by iterating booking identifiers and disrupt legitimate booking confirmations.

Affected Products

TrueBooker WordPress plugin versions prior to 1.3.0
WordPress sites exposing the booking confirmation endpoint
Any site using TrueBooker to collect appointment customer data

Discovery Timeline

2026-10-19 - CVE-2026-94229 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-94229

Vulnerability Analysis

The TrueBooker plugin exposes a booking confirmation summary that is retrieved using a booking identifier passed in the request. The plugin treats possession of the identifier as proof of ownership and skips any session, token, or capability check tied to the requesting user. An unauthenticated attacker who can reach the public confirmation endpoint can therefore request any booking record by varying the identifier.

Because booking identifiers are predictable or enumerable, an attacker can iterate over the identifier space and scrape customer records at scale. Each disclosed record exposes personal information submitted during booking, such as names, email addresses, phone numbers, and appointment metadata. The same unprotected flow allows an attacker to trigger logic that invalidates the legitimate customer's confirmation link, denying the customer access to their own booking.

Root Cause

The root cause is missing authorization on the confirmation summary handler. The plugin does not bind the booking identifier to a per-user secret, nonce, or session before returning the record. This is a classic CWE-639 authorization flaw where the user-controlled key is trusted as an authenticator.

Attack Vector

The attack is network based, requires no privileges, and needs no user interaction. An attacker sends crafted HTTP requests to the confirmation endpoint and increments or guesses the booking identifier. The server returns the confirmation summary for any valid identifier regardless of the requester's identity. See the WPScan Vulnerability Report for additional detail.

Detection Methods for CVE-2026-94229

Indicators of Compromise

Sequential or high-volume GET requests to TrueBooker confirmation URLs from a single source IP
Access log entries showing enumeration patterns across incrementing booking identifier values
Customer reports of broken or already invalidated confirmation links
Successful HTTP 200 responses to confirmation requests originating from unauthenticated clients

Detection Strategies

Monitor web server access logs for repeated requests to TrueBooker confirmation endpoints with varying identifier parameters
Deploy a Web Application Firewall rule that flags high-rate access to booking confirmation URLs from a single client
Correlate anonymous requests to the plugin endpoint with spikes in outbound data volume

Monitoring Recommendations

Baseline normal confirmation traffic volume per source and alert on deviations greater than two standard deviations
Track User-Agent and IP diversity across confirmation URL hits to surface scripted enumeration
Enable WordPress audit logging for the TrueBooker plugin and ship events to a centralized log platform for analysis

How to Mitigate CVE-2026-94229

Immediate Actions Required

Upgrade the TrueBooker plugin to version 1.3.0 or later on all WordPress sites
Inventory WordPress deployments for the TrueBooker plugin and prioritize public-facing sites
Review web server logs for enumeration activity against booking confirmation URLs since the plugin was installed
Notify affected customers if evidence of booking data access is identified

Patch Information

The vendor addressed the issue in TrueBooker 1.3.0 by enforcing ownership checks before returning booking confirmation data. Site administrators should apply the update through the WordPress plugin manager. Refer to the WPScan Vulnerability Report for the authoritative advisory.

Workarounds

Temporarily disable the TrueBooker plugin until the update is applied
Restrict access to booking confirmation URLs with a Web Application Firewall rule that enforces rate limits and blocks enumeration patterns
Rotate or invalidate existing booking identifiers after patching to limit the usefulness of previously harvested identifiers

bash

# Example WAF rate-limit rule (ModSecurity)
SecRule REQUEST_URI "@contains /truebooker/confirmation" \
    "id:1009001,phase:1,deny,status:429,\
    msg:'TrueBooker confirmation enumeration',\
    chain"
    SecRule IP:REQ_COUNT "@gt 20"