Live › vulnerability › CVE-2026-94229
Go to dashboardThe TrueBooker WordPress plugin before 1.3.0 does not check that a requester owns a booking before showing its confirmation summary. An unauthenticated attacker can enumerate booking IDs and read customers' personal information, and can also invalidate a customer's confirmation link.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the TrueBooker WordPress plugin before that use it to take appointment bookings are exposed, since the confirmation summary is reachable without logging in. Sites without this plugin, or already on or later, are not affected.
1.3.01.3.0No product ranges from the sources yet.
1.3.01.3.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as invalidate the customer's own confirmation link.
This page as .md · .json · in your agent: get_signal("CVE-2026-94229")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.