CVE-2026-94231: TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creation and Modification
Published Oct 19, 2026
·Updated
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices.
Affected Software
1 affected component
TrueBooker TrueBooker Appointment Booking<1.3.0
Event History
Oct 19, 2026
CVE Published
via MITRE·06:46 AM
Data Sourced
via MITRE·06:46 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are affected?
TrueBooker Appointment Booking versions 1.1.9 through 1.2.9 are affected. The issue is fixed in version 1.3.0.
2
Does an attacker need an account or user interaction?
No. The vulnerability can be exploited remotely without authentication or user interaction.
3
What can an unauthenticated attacker change?
An attacker can create and modify booking services and categories, including their prices.