CVE-2026-39663

CVE-2026-39663 is a missing authorization vulnerability in themetechmount TrueBooker appointment booking plugin versions up to 1.1.5, stemming from incorrectly configured access control security levels. The flaw allows unauthorized actions to be performed against the application without proper privilege verification. The vulnerability has a CVSS v3.1 score of 5.3 (Medium) with a network-based attack vector requiring no authentication or user interaction. Attack complexity is low, meaning exploitation requires minimal effort. The primary impact is integrity compromise, while confidentiality and availability remain unaffected. There is currently no evidence of active exploitation in the wild. The vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and is inactive on threat tracking lists. With an EPSS score of 0.00037 and a FAUCET risk score of 32.0/100, the immediate threat level remains low, though the authorization flaw warrants timely patching to prevent potential abuse.