WordPress Plugin Vulnerabilities

TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbitrary Price via Multiple AJAX Actions

Description

The plugin does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer accounts.

Proof of Concept

Affects Plugins

Plugin icon
truebooker-appointment-booking
Fixed in 1.3.0

References

CVE
CVE-2026-94230

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Amity Gilmour
Submitter
Amity Gilmour
Verified
Yes
WPVDB ID
05881cde-313e-47d5-a176-2b0b0051bca9

Timeline

Publicly Published
2026-10-16 (about 2 days ago)
Added
2026-10-09 (about 9 days ago)
Last Updated
2026-10-15 (about 3 days ago)

Other

Published
Title
Published
2026-10-04
Title
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder < 5.2.8 - Missing Authorization
Published
2023-12-07
Title
Smart Forms < 2.6.85 - Subscriber+ Arbitrary Options Update
Published
2022-06-02
Title
HTML2WP <= 1.0.0 - Subscriber+ Arbitrary File Deletion
Published
2025-12-31
Title
All in One Accessibility < 1.16 - Missing Authorization
Published
2026-02-19
Title
ShipTime: Discounted Shipping Rates < 1.1.5 - Missing Authorization