CVE-2026-18778: TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Customer PII Disclosure via Multiple AJAX Actions
Published Aug 19, 2026
·Updated
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the personal information of customers who booked an appointment, including their name, email address, phone number and postal address.
Affected Software
1 affected component
TrueBooker Appointment Booking<1.2.7
Event History
Aug 19, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Unauthenticated users can exploit the affected AJAX actions; no login or prior account is required.
2
What information could be exposed?
An attacker may retrieve appointment customers' names, email addresses, phone numbers, and postal addresses.
3
Which installations are affected?
TrueBooker Appointment Booking versions before 1.2.7 are affected.