CVE-2026-73347

Unauthenticated Privilege Escalation in TrueBooker = 1.2.6 versions...

CVE-2026-73347

The WordPress TrueBooker appointment booking plugin (versions ≤ 1.2.6) allows unauthenticated remote attackers to escalate privileges, scoring CVSS 9.8 (CRITICAL). No patch version or exploit details are provided in the documents; users should upgrade once a patched release is available.

EUVD-2026-62381

Unauthenticated Privilege Escalation in TrueBooker = 1.2.6 versions...

CVE-2026-73347 WordPress TrueBooker plugin <= 1.2.6 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in TrueBooker = 1.2.6 versions...

CVE-2026-73347 WordPress TrueBooker plugin <= 1.2.6 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in TrueBooker = 1.2.6 versions...

WordPress TrueBooker plugin <= 1.2.6 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin TrueBooker versions = 1.2.6...

CVE-2026-18777

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers...

CVE-2026-18778

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the personal information of customers who booked an appointment, including their name, email address, phone number and postal address...

CVE-2026-18779

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records...

CVE-2026-18776

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow...

EUVD-2026-62284

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records...

CVE-2026-18779 TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Appointment and Payment Record Deletion via update_appointment_booked

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records...

CVE-2026-18779 TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Appointment and Payment Record Deletion via update_appointment_booked

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records...

CVE-2026-18779

The TrueBooker WordPress plugin (versions before 1.2.7 ) contains a vulnerability due to missing authorization checks in an AJAX action, specifically the update_appointment_booked function. This flaw allows unauthenticated users to delete arbitrary appointment records, including associated bookin...

EUVD-2026-62283

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the personal information of customers who booked an appointment, including their name, email address, phone number and postal address...

CVE-2026-18778 TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Customer PII Disclosure via Multiple AJAX Actions

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the personal information of customers who booked an appointment, including their name, email address, phone number and postal address...

CVE-2026-18776 TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJAX Actions

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow...

CVE-2026-18778 TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Customer PII Disclosure via Multiple AJAX Actions

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the personal information of customers who booked an appointment, including their name, email address, phone number and postal address...

CVE-2026-18777

The TrueBooker WordPress plugin (versions before 1.2.7 ) is vulnerable to an unauthenticated arbitrary appointment status change due to improper authorization checks in an AJAX action (specifically the update_appointment_status functionality). An unauthenticated attacker can exploit this flaw to ...

CVE-2026-18777 TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Arbitrary Appointment Status Change via update_appointment_status

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers...