CVE-2026-1797: 
WordPress vulnerability analysis and mitigation

CVE-2026-1797 is a Sensitive Information Exposure vulnerability in the Appointment Booking and Scheduler Plugin – Truebooker for WordPress. It affects all versions up to and including 1.1.4, allowing unauthenticated attackers to directly access PHP view files and retrieve potentially sensitive information. The vulnerability was published on March 31, 2026, and a patch was made available in version 1.1.5. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-862 (Missing Authorization) — the plugin fails to enforce access controls on PHP view files, allowing them to be accessed directly via URL without any authentication check. Specifically, files such as truebooker-user.php within the plugin's main/views/ directory are publicly accessible, exposing whatever data they render. An attacker only needs network access to the WordPress site and knowledge of the file paths to exploit this vulnerability; no credentials, special configuration, or user interaction is required (GitHub Advisory, Wordfence).

Successful exploitation allows unauthenticated remote attackers to read sensitive information exposed through the plugin's PHP view files, which may include booking data, user details, or other application-level information. The impact is limited to confidentiality — there is no integrity or availability impact. While the scope is unchanged and lateral movement potential is low, exposed user data could facilitate further targeted attacks or privacy violations (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.029–0.044%, placing it in the 14th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Truebooker plugin (version ≤ 1.1.4) using tools like WPScan, Shodan, or by checking /wp-content/plugins/truebooker-appointment-booking/ for plugin presence.
2. Identify exposed view files: Locate publicly accessible PHP view files within the plugin directory, such as /wp-content/plugins/truebooker-appointment-booking/main/views/truebooker-user.php.
3. Direct file access: Send an unauthenticated HTTP GET request directly to the exposed PHP view file URL (e.g., https://target-site.com/wp-content/plugins/truebooker-appointment-booking/main/views/truebooker-user.php).
4. Harvest sensitive data: Review the response for any sensitive information rendered by the view file, such as user booking details, personal information, or application data (GitHub Advisory, Wordfence).

• Network: Unusual direct HTTP GET requests to paths matching /wp-content/plugins/truebooker-appointment-booking/main/views/*.php from external or unknown IP addresses.
• Logs: Web server access logs showing 200 OK responses to direct requests for PHP view files within the Truebooker plugin directory, particularly from automated scanners or unfamiliar user agents.
• File System: Presence of Truebooker plugin version 1.1.4 or earlier in the WordPress plugins directory (/wp-content/plugins/truebooker-appointment-booking/).

WordPress site administrators should upgrade the Truebooker plugin to version 1.1.5 or later, which addresses the missing authorization controls on PHP view files (Wordfence). As a temporary workaround, server-level access controls (e.g., Apache .htaccess or Nginx rules) can be configured to block direct HTTP access to PHP files within the plugin's views/ directory. Deploying a Web Application Firewall (WAF) with rules to block direct plugin file access requests is also recommended as a defense-in-depth measure.

The vulnerability was assigned and disclosed by Wordfence, which maintains a threat intelligence feed for WordPress plugin vulnerabilities. It received standard automated coverage from vulnerability aggregators including VulDB, CVEFeed, and ENISA's EUVD. No notable researcher commentary or significant media coverage beyond routine vulnerability tracking has been observed (Wordfence).