# TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 - Missing Authorization to Unauthenticated Service, Category and Appointment Creation/Modification

- **ID:** WPSEC-2026-0831
- **Plugin:** TrueBooker – Appointment Booking and Scheduler System (`truebooker-appointment-booking`), https://wordpress.org/plugins/truebooker-appointment-booking/
- **Affected versions:** all versions before 1.3.0
- **Fixed in:** 1.3.0 (Update to 1.3.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/truebooker-appointment-booking
- **Fix released:** 2026-10-12
- **Published:** 2026-10-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0831/

## Description

The truebooker-appointment-booking plugin for WordPress is vulnerable to unauthorized modification of data via the admin_service_savedata, admin_categories_savedata and admin_appoint_create AJAX actions in all versions up to, and including, 1.2.9, due to missing capability checks on handlers that were also registered for unauthenticated users and were protected only by nonces printed on every front-end page. This makes it possible for unauthenticated attackers to create and modify services (including their prices) and categories, and to create appointments for arbitrary customers.

## References

- https://wpsec.com/vuln/WPSEC-2026-0831/
- https://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.3.0/
- https://wordpress.org/plugins/truebooker-appointment-booking/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0831/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.