CVE-2026-48881: WordPress TrueBooker plugin <= 1.1.9 - Broken Access Control vulnerability

Synopsis

Broken access control in the WordPress TrueBooker plugin (versions 1.1.9 and earlier) allows an unauthenticated remote attacker to reach protected functionality without logging in. The vulnerability is exploitable over the network with no credentials and no victim interaction required, as reflected in the CVSS 9.1 critical score. Successful exploitation gives an attacker full read and write access to sensitive data managed by the plugin, including booking records and associated user information. No upstream fix has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress installation over the network; no physical or local access is needed.

• AuthenticationNot required

  No account or session token of any kind is required; the broken access control flaw is reachable by a completely anonymous request.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; the exploit is entirely server-side.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites.

Blast Radius

• An attacker reads protected booking records, customer personal information, and any other data the plugin stores or exposes through its access-controlled endpoints.
• An attacker writes to or modifies booking data, potentially creating, altering, or deleting reservations and associated records without authorization.
• Service availability is not directly impacted according to the CVSS availability token, but data integrity loss from unauthorized writes can cause functional disruption for site operators and end users.