CVE-2026-94229
MediumCVSS 5.3Summary
The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as invalidate the customer's own confirmation link.
Risk Assessment
An unauthenticated attacker can access customers' personal information and invalidate their confirmation links, constituting a privacy breach and potentially leading to further attacks. It may also disrupt the booking process.
Recommendation
Update the TrueBooker plugin to version 1.3.0 or later. Until then, consider disabling the plugin or implementing access controls for booking summaries.
Other vulnerabilities in TrueBooker WordPress plugin
See all- CVE-2026-94231Medium
The TrueBooker WordPress plugin before 1.3.0 does not have authorization checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices.
- CVE-2026-94230Medium
The TrueBooker WordPress plugin before 1.3.0 does not have authorization checks in some of its AJAX actions and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer accounts.
- CVE-2026-94228Medium
The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it checks is issued to unauthenticated visitors. This allows anyone to overwrite the plugin's entire configuration and discard any settings they do not supply.
Original NVD description (English source)
The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as invalidate the customer's own confirmation link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS