{
 "id": "WPSEC-2026-0833",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0833/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0833/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0833/index.md",
 "title": "TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 - Unauthenticated Insecure Direct Object Reference to Booking Summary Disclosure",
 "description": "The truebooker-appointment-booking plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'refappbkd' parameter of the [truebooker-bookingform] shortcode in all versions up to, and including, 1.2.9, due to the booking reference being only a base64-encoded sequential booking ID with no ownership check or signature. This makes it possible for unauthenticated attackers to view the booking summary of other customers' bookings whose summary has not been viewed yet, including name, address, email, phone and appointment details, and to trigger the booking confirmation emails.",
 "plugin": {
  "slug": "truebooker-appointment-booking",
  "name": "TrueBooker – Appointment Booking and Scheduler System",
  "full_name": "TrueBooker – Appointment Booking and Scheduler System",
  "wordpress_org": "https://wordpress.org/plugins/truebooker-appointment-booking/",
  "advisories_url": "https://wpsec.com/vuln/plugin/truebooker-appointment-booking/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/truebooker-appointment-booking"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.3.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.3.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.3.0",
 "remediation": "Update to 1.3.0 or later.",
 "fix_released": "2026-10-12T11:41:29+00:00",
 "published": "2026-10-13T12:45:11+00:00",
 "updated": "2026-10-13T12:13:48.504150+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0833/",
  "https://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.3.0/",
  "https://wordpress.org/plugins/truebooker-appointment-booking/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/truebooker-appointment-booking",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-13"
 }
}