Live › vulnerability › CVE-2026-94230
Go to dashboardThe TrueBooker WordPress plugin before 1.3.0 has missing authorisation checks on some AJAX actions and does not validate service prices on the server. An unauthenticated visitor can create bookings at a price they choose and attach them to arbitrary customer accounts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the TrueBooker WordPress plugin older than 1.3.0 that accept bookings through its AJAX endpoints. Sites without the plugin, or running 1.3.0 or later, are not affected.
No product ranges from the sources yet.
wp plugin get truebooker --field=version1.3.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer accounts.
This page as .md · .json · in your agent: get_signal("CVE-2026-94230")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.