{"id":"CVE-2026-94231","kind":"vulnerability","aliases":["CVE-2026-94231"],"related":[],"title":"TrueBooker WordPress plugin: unauthenticated users can change booking services and prices","description":"The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices.","summary":"The TrueBooker WordPress plugin before 1.3.0 is missing authorisation checks on some functions. An unauthenticated visitor can create and modify booking services and categories, including their prices.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","truebooker","wordpress"],"not_affected_if":["plugin-not-installed","version-1.3.0-or-later"],"how_to_check":"- Check the installed TrueBooker plugin version in the WordPress admin under Plugins, or with `wp plugin get truebooker --field=version` if WP-CLI is available.\n- Look for booking services or categories with unexpected names or prices.","fix":"- Update the TrueBooker plugin to `1.3.0` or later.\n- Review booking services, categories and prices for unexpected changes.","status":"open","published_at":"2026-10-19T07:16:32+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:26:28+00:00","updated_at":"2026-10-25T04:26:28+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:26:28Z","model":"claude-haiku-5-5","output":{"fix":"- Update the TrueBooker plugin to `1.3.0` or later.\n- Review booking services, categories and prices for unexpected changes.","reach":"internet","title":"TrueBooker WordPress plugin: unauthenticated users can change booking services and prices","impact":"medium","summary":"The TrueBooker WordPress plugin before 1.3.0 is missing authorisation checks on some functions. An unauthenticated visitor can create and modify booking services and categories, including their prices.","category":"package","nicknames":[],"who_cares":["wordpress","truebooker"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated users alter booking services, categories and prices","analyst_note":"","how_to_check":"- Check the installed TrueBooker plugin version in the WordPress admin under Plugins, or with `wp plugin get truebooker --field=version` if WP-CLI is available.\n- Look for booking services or categories with unexpected names or prices.","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-1.3.0-or-later"],"who_is_affected":"Sites running the TrueBooker WordPress plugin before 1.3.0 are exposed, since the flaw needs no login. Sites without this plugin can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000568,"input_tokens":3286,"output_tokens":478,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-94231':14A,17A '1.3.0':26B,53C 'allow':66C 'authoris':29B,57C 'book':8A,41B,73C 'categori':44B,76C 'chang':7A 'check':30B,58C 'creat':38B,70C 'cve':12A,15A 'function':33B,65C 'includ':45B,77C 'miss':28B 'modifi':40B,72C 'packag':18B 'place':60C 'plugin':3A,24B,51C 'price':11A,47B,79C 'servic':9A,42B,74C 'truebook':1A,19B,22B,49C 'unauthent':4A,35B,67C 'user':5A,68C 'visitor':36B 'wordpress':2A,20B,23B,50C","nicknames":[],"mitigations":[],"who_affected":"Sites running the TrueBooker WordPress plugin before 1.3.0 are exposed, since the flaw needs no login. Sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T07:16:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94231","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94231","severity":null,"published_at":"2026-10-19T07:16:32+00:00","modified_at":"2026-10-19T21:02:51+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}