---
id: "CVE-2026-94228"
kind: "vulnerability"
aliases: ["CVE-2026-94228"]
title: "TrueBooker WordPress plugin: anyone can overwrite its configuration"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "truebooker", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-19T07:16:32+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T04:26:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94228", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# TrueBooker WordPress plugin: anyone can overwrite its configuration

The TrueBooker WordPress plugin before 1.3.0 has a setup handler with no capability check, and the token it does verify is handed to unauthenticated visitors. An anonymous visitor can overwrite the plugin's entire configuration and wipe any setting they leave out.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed TrueBooker version in the WordPress admin plugin list or the plugin header in `wp-content/plugins/truebooker/`
- unknown

## Fix

- Update the TrueBooker plugin to `1.3.0` or later
- unknown

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94228

## From the sources

The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire configuration and to discard any setting they do not supply.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_