CVE-2026-18779

MediumCVSS 5.3

Published: 19/08/2026(UTC)Updated: 19/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

The TrueBooker WordPress plugin before 1.2.7 lacks proper authorization checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with associated booking items and payment records.

Risk Assessment

An attacker can delete all appointments and payment data, leading to data loss and service disruption.

Recommendation

Update the TrueBooker plugin to version 1.2.7 or later, which includes authorization fixes.

Original NVD description (English source)

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records.