Vulnerabilities / TrueBooker – Appointment Booking and Scheduler System / WPSEC-2026-0834
TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 - Unauthenticated Booking Price Manipulation
Medium 5.3
CWE-472Fixed in 1.3.0
- ID
- WPSEC-2026-0834
- Plugin
- TrueBooker – Appointment Booking and Scheduler System (truebooker-appointment-booking)
- Affected
- all versions before 1.3.0
- Remediation
- Update to 1.3.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-472
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-13
- Attack surface
- TrueBooker – Appointment Booking and Scheduler System on WPSec AttackSurface
- Fix released
- Published
Description
The truebooker-appointment-booking plugin for WordPress is vulnerable to booking price manipulation via the truebooker_add_cart and appointment_place AJAX actions in all versions up to, and including, 1.2.9, due to the cart price being calculated from the client-supplied 'truebooker_slot_price' and 'truebooker_service_qty' values instead of the server-side service price, and the payment method not being checked against the configured methods. This makes it possible for unauthenticated attackers to create bookings with arbitrary prices and totals, which avoids paying the real service price.
References
- https://wpsec.com/vuln/WPSEC-2026-0834/
- https://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.3.0/
- https://wordpress.org/plugins/truebooker-appointment-booking/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS