---
id: "CVE-2026-94230"
kind: "vulnerability"
aliases: ["CVE-2026-94230"]
title: "TrueBooker WordPress plugin: unauthenticated users can book at any price"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "truebooker", "wordpress"]
not_affected_if: ["plugin-1.3.0-or-later", "plugin-absent"]
published_at: "2026-10-19T07:16:32+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T04:26:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94230", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# TrueBooker WordPress plugin: unauthenticated users can book at any price

The TrueBooker WordPress plugin before 1.3.0 has missing authorisation checks on some AJAX actions and does not validate service prices on the server. An unauthenticated visitor can create bookings at a price they choose and attach them to arbitrary customer accounts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed TrueBooker version in the WordPress admin plugin list or with `wp plugin get truebooker --field=version`
- Review bookings for entries at unexpected prices or attached to accounts that did not request them

## Fix

- Update the TrueBooker plugin to `1.3.0` or later
- Review existing bookings for unexpected prices or account assignments

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94230

## From the sources

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer accounts.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_