# TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 - Unauthenticated Booking Price Manipulation

- **ID:** WPSEC-2026-0834
- **Plugin:** TrueBooker – Appointment Booking and Scheduler System (`truebooker-appointment-booking`), https://wordpress.org/plugins/truebooker-appointment-booking/
- **Affected versions:** all versions before 1.3.0
- **Fixed in:** 1.3.0 (Update to 1.3.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-472
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/truebooker-appointment-booking
- **Fix released:** 2026-10-12
- **Published:** 2026-10-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0834/

## Description

The truebooker-appointment-booking plugin for WordPress is vulnerable to booking price manipulation via the truebooker_add_cart and appointment_place AJAX actions in all versions up to, and including, 1.2.9, due to the cart price being calculated from the client-supplied 'truebooker_slot_price' and 'truebooker_service_qty' values instead of the server-side service price, and the payment method not being checked against the configured methods. This makes it possible for unauthenticated attackers to create bookings with arbitrary prices and totals, which avoids paying the real service price.

## References

- https://wpsec.com/vuln/WPSEC-2026-0834/
- https://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.3.0/
- https://wordpress.org/plugins/truebooker-appointment-booking/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0834/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.