{
 "id": "WPSEC-2026-0834",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0834/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0834/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0834/index.md",
 "title": "TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 - Unauthenticated Booking Price Manipulation",
 "description": "The truebooker-appointment-booking plugin for WordPress is vulnerable to booking price manipulation via the truebooker_add_cart and appointment_place AJAX actions in all versions up to, and including, 1.2.9, due to the cart price being calculated from the client-supplied 'truebooker_slot_price' and 'truebooker_service_qty' values instead of the server-side service price, and the payment method not being checked against the configured methods. This makes it possible for unauthenticated attackers to create bookings with arbitrary prices and totals, which avoids paying the real service price.",
 "plugin": {
  "slug": "truebooker-appointment-booking",
  "name": "TrueBooker – Appointment Booking and Scheduler System",
  "full_name": "TrueBooker – Appointment Booking and Scheduler System",
  "wordpress_org": "https://wordpress.org/plugins/truebooker-appointment-booking/",
  "advisories_url": "https://wpsec.com/vuln/plugin/truebooker-appointment-booking/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/truebooker-appointment-booking"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-472"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.3.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.3.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.3.0",
 "remediation": "Update to 1.3.0 or later.",
 "fix_released": "2026-10-12T11:41:29+00:00",
 "published": "2026-10-13T12:45:11+00:00",
 "updated": "2026-10-13T12:13:48.504150+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0834/",
  "https://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.3.0/",
  "https://wordpress.org/plugins/truebooker-appointment-booking/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/truebooker-appointment-booking",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-13"
 }
}