---
id: "CVE-2026-94229"
kind: "vulnerability"
aliases: ["CVE-2026-94229"]
title: "TrueBooker WordPress plugin exposes customer booking details to unauthenticated users"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "truebooker", "wordpress"]
not_affected_if: ["default-config"]
published_at: "2026-10-19T07:16:32+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T04:26:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94229", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# TrueBooker WordPress plugin exposes customer booking details to unauthenticated users

The TrueBooker WordPress plugin before 1.3.0 does not check that a requester owns a booking before showing its confirmation summary. An unauthenticated attacker can enumerate booking IDs and read customers' personal information, and can also invalidate a customer's confirmation link.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed TrueBooker version in the WordPress admin plugin list or in the plugin's main file header, and confirm whether it is below `1.3.0`
- unknown

## Fix

- Update the TrueBooker plugin to `1.3.0` or later
- unknown

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94229

## From the sources

The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as invalidate the customer's own confirmation link.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_