Live › vulnerability › CVE-2026-94228
Go to dashboardThe TrueBooker WordPress plugin before 1.3.0 has a setup handler with no capability check, and the token it does verify is handed to unauthenticated visitors. An anonymous visitor can overwrite the plugin's entire configuration and wipe any setting they leave out.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the TrueBooker WordPress plugin before are exposed, because its setup handler accepts configuration changes from anonymous visitors. Sites that do not have the plugin installed, or run a fixed version, are not affected. The sources do not say whether the flaw depends on a specific plugin setting being enabled.
1.3.0No product ranges from the sources yet.
wp-content/plugins/truebooker/1.3.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire configuration and to discard any setting they do not supply.
This page as .md · .json · in your agent: get_signal("CVE-2026-94228")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.