Vulnerabilities / TrueBooker – Appointment Booking and Scheduler System / WPSEC-2026-0831
TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 - Missing Authorization to Unauthenticated Service, Category and Appointment Creation/Modification
Medium 5.3
CWE-862Fixed in 1.3.0
- ID
- WPSEC-2026-0831
- Plugin
- TrueBooker – Appointment Booking and Scheduler System (truebooker-appointment-booking)
- Affected
- all versions before 1.3.0
- Remediation
- Update to 1.3.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-13
- Attack surface
- TrueBooker – Appointment Booking and Scheduler System on WPSec AttackSurface
- Fix released
- Published
Description
The truebooker-appointment-booking plugin for WordPress is vulnerable to unauthorized modification of data via the admin_service_savedata, admin_categories_savedata and admin_appoint_create AJAX actions in all versions up to, and including, 1.2.9, due to missing capability checks on handlers that were also registered for unauthenticated users and were protected only by nonces printed on every front-end page. This makes it possible for unauthenticated attackers to create and modify services (including their prices) and categories, and to create appointments for arbitrary customers.
References
- https://wpsec.com/vuln/WPSEC-2026-0831/
- https://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.3.0/
- https://wordpress.org/plugins/truebooker-appointment-booking/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS