CVE-2026-94229

The TrueBooker WordPress plugin (versions 1.1.9 through 1.2.9) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The software fails to verify if a requester owns a specific booking before rendering the confirmation summary. This allows unauthenticated attackers to enumerate bookin...