Truebooker – Appointment Booking and Scheduler System Security & Risk Analysis

The "truebooker-appointment-booking" plugin version 1.1.5 presents a mixed security posture. While the code analysis indicates a positive trend in using prepared statements for SQL queries and a good number of nonce checks, there are significant concerns regarding its attack surface. A substantial number of AJAX handlers (8 out of 13) lack proper authentication checks, creating direct entry points for potential attackers. The absence of capability checks is also a notable weakness.

The vulnerability history reveals a pattern of critical and medium severity vulnerabilities, including missing authorization, CSRF, and SQL injection. The fact that the last vulnerability was in 2025 suggests that while recent issues might have been addressed, the plugin has a history of introducing security flaws. The presence of critical vulnerabilities in the past, even if currently patched, warrants caution and highlights potential areas of recurring weakness in the codebase.

Overall, while the plugin demonstrates some good practices like prepared statements and nonce checks, the large number of unprotected AJAX endpoints and its history of critical vulnerabilities mean users should exercise caution. The lack of capability checks on its entry points is a significant security gap that needs immediate attention. A thorough security audit focusing on authorization and input validation for the unprotected AJAX handlers is highly recommended.