Live › vulnerability › CVE-2026-94231
Go to dashboardThe TrueBooker WordPress plugin before 1.3.0 is missing authorisation checks on some functions. An unauthenticated visitor can create and modify booking services and categories, including their prices.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the TrueBooker WordPress plugin before 1.3.0 are exposed, since the flaw needs no login. Sites without this plugin can skip it.
No product ranges from the sources yet.
wp plugin get truebooker --field=version if WP-CLI is available.1.3.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices.
This page as .md · .json · in your agent: get_signal("CVE-2026-94231")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.