TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 - Missing Authorization to Authenticated (Subscriber+) Category, Service, Customer and Appointment Deletion

ID

WPSEC-2026-0832

Plugin

TrueBooker – Appointment Booking and Scheduler System (truebooker-appointment-booking)

Affected

all versions before 1.3.0

Remediation

Update to 1.3.0 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness

CWE-862

Usage

Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-13

Attack surface

TrueBooker – Appointment Booking and Scheduler System on WPSec AttackSurface

Fix released

2026-10-12

Published

2026-10-13

Description

The truebooker-appointment-booking plugin for WordPress is vulnerable to unauthorized deletion of data via the delete_categories, delete_services, delete_customer and delete_appointments admin-post actions in all versions up to, and including, 1.2.9, due to missing capability checks and nonce checks that redirect without stopping execution. This makes it possible for authenticated attackers with Subscriber-level access and above to delete arbitrary categories, services, customer records and appointments.

References

• https://wpsec.com/vuln/WPSEC-2026-0832/
• https://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.3.0/
• https://wordpress.org/plugins/truebooker-appointment-booking/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS