CVE-2026-18778 is an information exposure vulnerability (CWE-200) in the TrueBooker WordPress plugin. Versions prior to 1.2.7 lack proper authorization checks on certain AJAX endpoints, enabling unauthenticated attackers to retrieve sensitive personal information of customers who booked appointments. The exposed data includes names, email addresses, phone numbers, and postal addresses. The vulnerability is rated medium severity with a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). No known exploits in the wild have been reported, and the plugin is not a cloud service.

Unauthenticated attackers can access personal customer information without authorization, leading to potential privacy violations and data leakage. The exposed data includes personally identifiable information (PII) such as names, emails, phone numbers, and postal addresses. There is no indication of impact on data integrity or availability.

Upgrade the TrueBooker plugin to version 1.2.7 or later, where this vulnerability has been fixed. Since the vulnerability is due to missing authorization checks, applying the official patch or update is the recommended remediation. Patch status is confirmed by the version range affected and fixed in 1.2.7. No additional vendor advisory was provided, but the version-based fix is authoritative.