{
 "id": "WPSEC-2026-0832",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0832/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0832/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0832/index.md",
 "title": "TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 - Missing Authorization to Authenticated (Subscriber+) Category, Service, Customer and Appointment Deletion",
 "description": "The truebooker-appointment-booking plugin for WordPress is vulnerable to unauthorized deletion of data via the delete_categories, delete_services, delete_customer and delete_appointments admin-post actions in all versions up to, and including, 1.2.9, due to missing capability checks and nonce checks that redirect without stopping execution. This makes it possible for authenticated attackers with Subscriber-level access and above to delete arbitrary categories, services, customer records and appointments.",
 "plugin": {
  "slug": "truebooker-appointment-booking",
  "name": "TrueBooker – Appointment Booking and Scheduler System",
  "full_name": "TrueBooker – Appointment Booking and Scheduler System",
  "wordpress_org": "https://wordpress.org/plugins/truebooker-appointment-booking/",
  "advisories_url": "https://wpsec.com/vuln/plugin/truebooker-appointment-booking/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/truebooker-appointment-booking"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.3.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.3.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.3.0",
 "remediation": "Update to 1.3.0 or later.",
 "fix_released": "2026-10-12T11:41:29+00:00",
 "published": "2026-10-13T12:45:11+00:00",
 "updated": "2026-10-13T12:13:48.504150+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0832/",
  "https://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.3.0/",
  "https://wordpress.org/plugins/truebooker-appointment-booking/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/truebooker-appointment-booking",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-13"
 }
}