# TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 - Missing Authorization to Authenticated (Subscriber+) Category, Service, Customer and Appointment Deletion

- **ID:** WPSEC-2026-0832
- **Plugin:** TrueBooker – Appointment Booking and Scheduler System (`truebooker-appointment-booking`), https://wordpress.org/plugins/truebooker-appointment-booking/
- **Affected versions:** all versions before 1.3.0
- **Fixed in:** 1.3.0 (Update to 1.3.0 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/truebooker-appointment-booking
- **Fix released:** 2026-10-12
- **Published:** 2026-10-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0832/

## Description

The truebooker-appointment-booking plugin for WordPress is vulnerable to unauthorized deletion of data via the delete_categories, delete_services, delete_customer and delete_appointments admin-post actions in all versions up to, and including, 1.2.9, due to missing capability checks and nonce checks that redirect without stopping execution. This makes it possible for authenticated attackers with Subscriber-level access and above to delete arbitrary categories, services, customer records and appointments.

## References

- https://wpsec.com/vuln/WPSEC-2026-0832/
- https://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.3.0/
- https://wordpress.org/plugins/truebooker-appointment-booking/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0832/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.