CVE-2026-94230: TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbitrary Price via Multiple AJAX Actions
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer accounts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote user can exploit it. No account, privileges, or user interaction are required.
What can an attacker do?
An attacker can create bookings with a price they choose and associate those bookings with arbitrary customer accounts. The issue affects the plugin's AJAX actions that lack authorization checks and server-side price validation.
Which versions are affected?
TrueBooker Appointment Booking versions before 1.3.0 are affected. The reported affected range includes 1.1.9 through 1.2.9.