CVE-2026-18315-PoC

CVE-2026-18315-PoC Proof-of-concept for CVE-2026-18315 TrueBooker = 1.2.6 WordPress Plugin: Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover...

TrueBooker <= 1.0.2 - SQL Injection

The TrueBooker Appointment Booking and Scheduler Plugin. plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 1.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass

TrueBooker – Appointment Booking and Scheduler System WordPress plugin = 1.2.6 contains an authorization bypass through user-controlled key caused by lack of authentication in adminusercreatecus AJAX handler, letting unauthenticated attackers take over any user account by overwriting email and...

CVE-2026-94228

The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire configuration and to discard any setting they do not supply...

CVE-2026-94231

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices...

CVE-2026-94229

The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as...

CVE-2026-94230

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer...

CVE-2026-94231

The TrueBooker WordPress plugin (versions 1.1.9 through 1.2.9 ) is vulnerable to an authorization bypass due to missing checks in specific functionalities. This flaw allows unauthenticated users to create and modify booking services and categories , which includes the ability to alter associated ...

CVE-2026-94231 TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creation and Modification

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices...

CVE-2026-94230

The TrueBooker WordPress plugin versions prior to 1.3.0 contains a vulnerability where certain AJAX actions lack proper authorization checks. Additionally, the application fails to perform server-side validation on the submitted service price. These flaws allow unauthenticated users to create boo...

EUVD-2026-104105

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices...

CVE-2026-94230 TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbitrary Price via Multiple AJAX Actions

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer...

EUVD-2026-104104

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer...

CVE-2026-94229

The TrueBooker WordPress plugin (versions 1.1.9 through 1.2.9) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The software fails to verify if a requester owns a specific booking before rendering the confirmation summary. This allows unauthenticated attackers to enumerate bookin...

CVE-2026-94229 TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via IDOR in 'refappbkd' Parameter

The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as...

EUVD-2026-104103

The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as...

EUVD-2026-104102

The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire configuration and to discard any setting they do not supply...

CVE-2026-94228

The TrueBooker WordPress plugin (versions 1.1.9 through 1.2.9) is vulnerable to an unauthenticated plugin settings overwrite . The root cause is a lack of capability checks on one of the plugin's setup handlers; furthermore, the token being validated is issued to unauthenticated visitors. This al...

CVE-2026-94228 TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite via admin_setting_setup_data

The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire configuration and to discard any setting they do not supply...

CVE-2026-94229: Authorization Bypass Through User-Controlled Key

The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as...