CVE-2026-94228: TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite via admin_setting_setup_data
The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire configuration and to discard any setting they do not supply.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TrueBooker Appointment Bookingto a version that resolves this vulnerability.Fixed in 1.3.0
Event History
Frequently Asked Questions
Which deployments are exposed?
TrueBooker Appointment Booking versions before 1.3.0 are affected. The issue is reachable remotely and does not require an authenticated WordPress account.
What does an attacker need to exploit this?
An attacker only needs access to the affected site's plugin setup handler. Although the handler checks a token, that token is issued to unauthenticated visitors, so it does not prevent unauthenticated exploitation.
What is the practical impact of exploitation?
An attacker can overwrite the plugin's entire configuration. Settings omitted from the attacker's request can be discarded, potentially disrupting the plugin's configured behavior.
How can I tell whether remediation is needed?
Check the installed TrueBooker Appointment Booking plugin version. Versions 1.1.9 through 1.2.9, and more generally any version before 1.3.0, require remediation.