CVE-2026-94229

The TrueBooker WordPress plugin (versions 1.1.9 through 1.2.9) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The software fails to verify if a requester owns a specific booking before rendering the confirmation summary. This allows unauthenticated attackers to enumerate bookin...

CVE-2026-94229 TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via IDOR in 'refappbkd' Parameter

The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as...