{"id":"CVE-2026-94229","kind":"vulnerability","aliases":["CVE-2026-94229"],"related":[],"title":"TrueBooker WordPress plugin exposes customer booking details to unauthenticated users","description":"The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as invalidate the customer's own confirmation link.","summary":"The TrueBooker WordPress plugin before 1.3.0 does not check that a requester owns a booking before showing its confirmation summary. An unauthenticated attacker can enumerate booking IDs and read customers' personal information, and can also invalidate a customer's confirmation link.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","truebooker","wordpress"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed TrueBooker version in the WordPress admin plugin list or in the plugin's main file header, and confirm whether it is below `1.3.0`\n- unknown","fix":"- Update the TrueBooker plugin to `1.3.0` or later\n- unknown","status":"open","published_at":"2026-10-19T07:16:32+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:26:32+00:00","updated_at":"2026-10-25T04:26:32+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:26:32Z","model":"claude-haiku-5-5","output":{"fix":"- Update the TrueBooker plugin to `1.3.0` or later\n- unknown","reach":"internet","title":"TrueBooker WordPress plugin exposes customer booking details to unauthenticated users","impact":"medium","summary":"The TrueBooker WordPress plugin before 1.3.0 does not check that a requester owns a booking before showing its confirmation summary. An unauthenticated attacker can enumerate booking IDs and read customers' personal information, and can also invalidate a customer's confirmation link.","category":"package","nicknames":[],"who_cares":["wordpress","truebooker","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Customers' personal booking data readable and booking links invalidated by anyone","analyst_note":"Confirm the exact booking endpoint and fixed version against the plugin changelog or the NVD entry for CVE-2026-94229.","how_to_check":"- Check the installed TrueBooker version in the WordPress admin plugin list or in the plugin's main file header, and confirm whether it is below `1.3.0`\n- unknown","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Sites running the TrueBooker WordPress plugin before `1.3.0` that use it to take appointment bookings are exposed, since the confirmation summary is reachable without logging in. Sites without this plugin, or already on `1.3.0` or later, are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000601,"input_tokens":3329,"output_tokens":537,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-94229':13A,16A '1.3.0':28B,69C 'allow':84C 'also':57B 'appoint':101C 'attack':45B,86C 'book':6A,37B,48B,78C,89C,99C 'check':31B 'confirm':41B,62B,82C,110C 'custom':5A,52B,60B,97C,107C 'cve':11A,14A 'detail':7A 'enumer':47B,88C 'expos':4A 'host':20B 'id':49B 'identifi':90C 'inform':54B,95C 'invalid':58B,105C 'link':63B,111C 'own':35B,76C 'packag':17B 'person':53B,94C 'plugin':3A,26B,67C 'read':51B 'render':80C 'request':34B,75C 'retriev':92C 'self':19B 'self-host':18B 'show':39B 'summari':42B,83C 'truebook':1A,21B,24B,65C 'unauthent':9A,44B,85C 'user':10A 'verifi':72C 'well':103C 'wordpress':2A,22B,25B,66C","nicknames":[],"mitigations":[],"who_affected":"Sites running the TrueBooker WordPress plugin before `1.3.0` that use it to take appointment bookings are exposed, since the confirmation summary is reachable without logging in. Sites without this plugin, or already on `1.3.0` or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T07:16:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94229","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94229","severity":null,"published_at":"2026-10-19T07:16:32+00:00","modified_at":"2026-10-19T21:02:51+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}