{"id":"CVE-2026-94228","kind":"vulnerability","aliases":["CVE-2026-94228"],"related":[],"title":"TrueBooker WordPress plugin: anyone can overwrite its configuration","description":"The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire configuration and to discard any setting they do not supply.","summary":"The TrueBooker WordPress plugin before 1.3.0 has a setup handler with no capability check, and the token it does verify is handed to unauthenticated visitors. An anonymous visitor can overwrite the plugin's entire configuration and wipe any setting they leave out.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","truebooker","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed TrueBooker version in the WordPress admin plugin list or the plugin header in `wp-content/plugins/truebooker/`\n- unknown","fix":"- Update the TrueBooker plugin to `1.3.0` or later\n- unknown","status":"open","published_at":"2026-10-19T07:16:32+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:26:32+00:00","updated_at":"2026-10-25T04:26:32+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:26:32Z","model":"claude-haiku-5-5","output":{"fix":"- Update the TrueBooker plugin to `1.3.0` or later\n- unknown","reach":"internet","title":"TrueBooker WordPress plugin: anyone can overwrite its configuration","impact":"medium","summary":"The TrueBooker WordPress plugin before 1.3.0 has a setup handler with no capability check, and the token it does verify is handed to unauthenticated visitors. An anonymous visitor can overwrite the plugin's entire configuration and wipe any setting they leave out.","category":"package","nicknames":[],"who_cares":["wordpress","truebooker"],"confidence":0.7,"needs_auth":"no","worst_case":"Anonymous visitors overwrite the plugin's full configuration and discard settings","analyst_note":"","how_to_check":"- Check the installed TrueBooker version in the WordPress admin plugin list or the plugin header in `wp-content/plugins/truebooker/`\n- unknown","needs_analyst":false,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the TrueBooker WordPress plugin before `1.3.0` are exposed, because its setup handler accepts configuration changes from anonymous visitors. Sites that do not have the plugin installed, or run a fixed version, are not affected. The sources do not say whether the flaw depends on a specific plugin setting being enabled.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000587,"input_tokens":3316,"output_tokens":511,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,13A '-94228':11A,14A '1.3.0':23B,64C 'allow':88C 'anonym':44B 'anyon':4A,89C 'capabl':30B,69C 'check':31B,70C,82C 'configur':8A,52B,96C 'cve':9A,12A 'discard':99C 'entir':51B,95C 'hand':39B 'handler':27B,76C 'issu':84C 'leav':58B 'one':72C 'overwrit':6A,47B,91C 'packag':15B 'perform':67C 'plugin':3A,21B,49B,62C,93C 'set':56B,101C 'setup':26B,75C 'suppli':105C 'token':34B,79C 'truebook':1A,16B,19B,60C 'unauthent':41B,86C 'verifi':37B 'visitor':42B,45B,87C 'wipe':54B 'wordpress':2A,17B,20B,61C","nicknames":[],"mitigations":[],"who_affected":"Sites running the TrueBooker WordPress plugin before `1.3.0` are exposed, because its setup handler accepts configuration changes from anonymous visitors. Sites that do not have the plugin installed, or run a fixed version, are not affected. The sources do not say whether the flaw depends on a specific plugin setting being enabled.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T07:16:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94228","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94228","severity":null,"published_at":"2026-10-19T07:16:32+00:00","modified_at":"2026-10-19T21:02:51+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}