CVE-2026-1797
published 2026-03-31CVE-2026-1797: The Appointment Booking and Scheduler Plugin – Truebooker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and…
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.21%
9.9th percentile
The Appointment Booking and Scheduler Plugin – Truebooker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 through views php files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed views php files via direct access.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| themetechmount | truebooker_appointment_booking_and_scheduler_system | <= 1.1.4 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-1797 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 9.8
CVE-2026-1797 [CRITICAL] CVE-2026-1797 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-1797 :
WordPress vulnerability analysis and mitigation
The Appointment Booking and Scheduler Plugin – Truebooker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 through views php files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed views php files via direct access.
Source : NVD
## 5.3
Score
Published March 31, 2026
Severity MEDIUM
CNA Score 5.3
Affected Technologies
WordPress
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 11.5
Exploitation Probability (EPSS) N/A
Affected packages and libraries
truebooker-appointment-booking
Sources
Bugzilla
CVE-2026-11785 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in SSO token handler [fedora-all]
bugzilla·2026-06-30·CVSS 4.3
CVE-2026-11785 [MEDIUM] CVE-2026-11785 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in SSO token handler [fedora-all]
CVE-2026-11785 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in SSO token handler [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A type confusion bug in extop_handle_ldapssotoken_request() (extendop.c) passes a stack pointer (&rc) to ber_printf with format 'i' which expects an integer. The low 32 bits of a stack address are encoded into every SSO token LDAP extended operation response.
Any authenticated non-administrator user can extract partial stack address information. SSO token feature enabled by default with auto-generated secret (Issue #1797). Po
Bugzilla
CVE-2026-11785 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in SSO token handler
bugzilla·2026-06-05·CVSS 4.3
CVE-2026-11785 [MEDIUM] CVE-2026-11785 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in SSO token handler
CVE-2026-11785 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in SSO token handler
A type confusion bug in extop_handle_ldapssotoken_request() (extendop.c) passes a stack pointer (&rc) to ber_printf with format 'i' which expects an integer. The low 32 bits of a stack address are encoded into every SSO token LDAP extended operation response.
Any authenticated non-administrator user can extract partial stack address information. SSO token feature enabled by default with auto-generated secret (Issue #1797). PoC confirmed on Fedora 42: INTEGER=0x8e7faed8 leaked. Reduces stack ASLR entropy but is not a full bypass.
2026-03-31
Published