CVE-2026-1797

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1797", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-03T10:00:39.307Z", "datePublished": "2026-03-31T04:25:31.834Z", "dateUpdated": "2026-04-08T16:51:51.528Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:51.528Z"}, "affected": [{"vendor": "themetechmount", "product": "TrueBooker \u2013 Appointment Booking and Scheduler System", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Appointment Booking and Scheduler Plugin \u2013 Truebooker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 through views php files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed views php files via direct access."}], "title": "Truebooker - Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ebe8b63-ea43-4e39-9fdf-e28fb4638433?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/truebooker-appointment-booking/tags/1.1.2/main/views/truebooker-user.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kazuma Matsumoto"}], "timeline": [{"time": "2026-03-30T16:18:30.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-31T13:48:44.459263Z", "id": "CVE-2026-1797", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T13:49:19.325Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1797", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-31T13:48:44.459263Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T13:49:08.389Z"}}], "cna": {"title": "Truebooker - Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files", "credits": [{"lang": "en", "type": "finder", "value": "Kazuma Matsumoto"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "themetechmount", "product": "TrueBooker \u2013 Appointment Booking and Scheduler System", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-30T16:18:30.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ebe8b63-ea43-4e39-9fdf-e28fb4638433?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/truebooker-appointment-booking/tags/1.1.2/main/views/truebooker-user.php"}], "descriptions": [{"lang": "en", "value": "The Appointment Booking and Scheduler Plugin \u2013 Truebooker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 through views php files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed views php files via direct access."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:51.528Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1797", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:51:51.528Z", "dateReserved": "2026-02-03T10:00:39.307Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-31T04:25:31.834Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "TrueBooker \u2013 Appointment Booking and Scheduler System", "vendor": "themetechmount", "versions": [{"lessThanOrEqual": "1.1.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Appointment Booking and Scheduler Plugin \u2013 Truebooker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 through views php files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed views php files via direct access."}, {"lang": "es", "value": "El plugin Appointment Booking and Scheduler Plugin \u2013 Truebooker para WordPress es vulnerable a la Exposici\u00f3n de Informaci\u00f3n Sensible en todas las versiones hasta la 1.1.4, inclusive, a trav\u00e9s de los archivos PHP de vistas. Esto permite a atacantes no autenticados ver informaci\u00f3n potencialmente sensible contenida en los archivos PHP de vistas expuestos mediante acceso directo."}], "id": "CVE-2026-1797", "lastModified": "2026-06-17T10:16:31.957", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1797", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-31T13:48:44.459263Z", "version": "2.0.3"}}]}, "published": "2026-03-31T05:16:10.867", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/truebooker-appointment-booking/tags/1.1.2/main/views/truebooker-user.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ebe8b63-ea43-4e39-9fdf-e28fb4638433?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1.4]"}}], "enrichment": {"confidence": 80.0, "confidence_source": "matching", "scores": [{"score": 80.0, "source": "matching"}]}, "original": {"product": "Truebooker \u2013 Appointment Booking and Scheduler System", "source": "cna", "vendor": "themetechmount"}, "product": "truebooker-appointment-booking", "vendor": "themetechmount"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-31T06:21:08.120349+00:00", "value": {"mitigation_remediation": ["Update the Truebooker plugin to the latest available version (>=1.1.5) to remove the exposed view files."], "summary": {"action": "Apply Patch", "impact": "Sensitive Information Exposure"}, "threat_synthesis": {"affected_systems": "All installations of the Truebooker \u2013 Appointment Booking and Scheduler System with versions up to and including 1.1.4 are impacted. The issue stems from the views directory within the plugin, where PHP files are exposed to web access. Users of older WordPress sites running this plugin version should review their configurations for potential data exposure.", "description_and_impact": "The vulnerability allows unauthenticated users to directly access view PHP files within the Truebooker plugin. These files can contain sensitive booking and user information, making it possible to read data that should be protected. The weakness is classified as Missing Authorization, as the plugin fails to enforce proper access controls on these files.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a medium severity vulnerability that does not involve code execution or privilege escalation, but it carries confidentiality risk. Exploitation is straightforward: attackers simply request the exposed PHP file URLs, which triggers the disclosure. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Overall, this vulnerability is easy to exploit and should be mitigated promptly."}}}}, "created": "2026-03-31T19:56:17.483161+00:00", "updated": "2026-04-03T09:10:31.870899+00:00", "vendors": ["themetechmount", "themetechmount$PRODUCT$truebooker-appointment-booking", "wordpress", "wordpress$PRODUCT$wordpress"]}