Exploitation Research Plan - CVE-2026-48881

1. Vulnerability Summary

The TrueBooker – Appointment Booking and Scheduler System plugin (<= 1.1.9) contains a Missing Authorization vulnerability in its setup wizard AJAX handlers. The plugin registers several AJAX actions—most notably truebooker_skip_wizard and potentially admin_setting_setup_data—without implementing sufficient capability checks (current_user_can()) or verifying nonces. This allows unauthenticated attackers to perform unauthorized administrative actions, such as skipping the plugin's configuration wizard or modifying plugin settings.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: truebooker_skip_wizard (Primary), admin_setting_setup_data (Secondary)
• Method: POST
• Authentication: Unauthenticated (PR:N)
• Preconditions: The plugin must be active. The setup wizard is typically active on fresh installations.
• Vulnerable Parameter: action=truebooker_skip_wizard

3. Code Flow

1. Entry Point (Client): In assets/js/setup_wizard.js, the #tb-skip button has a click event handler (line 64) that sends an unauthenticated AJAX request:

   jQuery('#tb-skip').on('click', function(e){
       e.