CVE-2026-94229: CWE-639 Authorization Bypass Through User-Controlled Key in TrueBooker

The TrueBooker WordPress plugin before version 1.3.0 contains an authorization bypass vulnerability (CWE-639) where it does not verify that the requester owns a booking before rendering its confirmation summary. This flaw allows unauthenticated attackers to enumerate booking identifiers, retrieve personal information of customers who booked appointments, and invalidate confirmation links belonging to customers. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

An attacker can enumerate booking identifiers without authentication, leading to unauthorized disclosure of personal customer information. Additionally, the attacker can invalidate legitimate customers' confirmation links, potentially disrupting appointment confirmations. There is no indication of integrity or availability impact beyond link invalidation. No known exploits are reported in the wild.

No official patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to booking confirmation pages and monitor for unusual access patterns related to booking identifiers.