---
id: "CVE-2026-94231"
kind: "vulnerability"
aliases: ["CVE-2026-94231"]
title: "TrueBooker WordPress plugin: unauthenticated users can change booking services and prices"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "truebooker", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-1.3.0-or-later"]
published_at: "2026-10-19T07:16:32+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T04:26:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94231", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# TrueBooker WordPress plugin: unauthenticated users can change booking services and prices

The TrueBooker WordPress plugin before 1.3.0 is missing authorisation checks on some functions. An unauthenticated visitor can create and modify booking services and categories, including their prices.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed TrueBooker plugin version in the WordPress admin under Plugins, or with `wp plugin get truebooker --field=version` if WP-CLI is available.
- Look for booking services or categories with unexpected names or prices.

## Fix

- Update the TrueBooker plugin to `1.3.0` or later.
- Review booking services, categories and prices for unexpected changes.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94231

## From the sources

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_