CVE-2026-94229: TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via IDOR in 'refappbkd' Parameter
The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as invalidate the customer's own confirmation link.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
TrueBooker Appointment Booking versions before 1.3.0 are affected. The issue allows access to booking confirmation summaries without authenticating as the booking owner.
What does an attacker need to exploit this issue?
An attacker needs network access to the affected site and a booking identifier to supply through the refappbkd parameter. No account, privileges, or user interaction are required, and identifiers can be enumerated.
What information or impact can result from exploitation?
An attacker can retrieve personal information belonging to customers who booked appointments. They can also invalidate a customer's confirmation link.
How can I determine whether my site may already be exposed?
Confirm whether the site runs a TrueBooker Appointment Booking version earlier than 1.3.0. Review requests to confirmation-summary functionality for refappbkd values, particularly sequences of differing or enumerated booking identifiers from unauthenticated clients.