{
 "id": "WPSEC-2026-0831",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0831/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0831/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0831/index.md",
 "title": "TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 - Missing Authorization to Unauthenticated Service, Category and Appointment Creation/Modification",
 "description": "The truebooker-appointment-booking plugin for WordPress is vulnerable to unauthorized modification of data via the admin_service_savedata, admin_categories_savedata and admin_appoint_create AJAX actions in all versions up to, and including, 1.2.9, due to missing capability checks on handlers that were also registered for unauthenticated users and were protected only by nonces printed on every front-end page. This makes it possible for unauthenticated attackers to create and modify services (including their prices) and categories, and to create appointments for arbitrary customers.",
 "plugin": {
  "slug": "truebooker-appointment-booking",
  "name": "TrueBooker – Appointment Booking and Scheduler System",
  "full_name": "TrueBooker – Appointment Booking and Scheduler System",
  "wordpress_org": "https://wordpress.org/plugins/truebooker-appointment-booking/",
  "advisories_url": "https://wpsec.com/vuln/plugin/truebooker-appointment-booking/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/truebooker-appointment-booking"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.3.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.3.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.3.0",
 "remediation": "Update to 1.3.0 or later.",
 "fix_released": "2026-10-12T11:41:29+00:00",
 "published": "2026-10-13T12:45:11+00:00",
 "updated": "2026-10-13T12:13:48.504150+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0831/",
  "https://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.3.0/",
  "https://wordpress.org/plugins/truebooker-appointment-booking/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/truebooker-appointment-booking",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-13"
 }
}