TrueBooker

Vulnerabilities

• CVE-2026-14349

  TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action

  Critical 9.8

• CVE-2026-18315

  TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter

  Critical 9.8

• CVE-2026-73347

  WordPress TrueBooker plugin <= 1.2.6 - Privilege Escalation vulnerability

  Critical 9.8

• CVE-2026-16142

  TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter

  Critical 9.8

• CVE-2026-14365

  TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id'

  Critical 9.8

• CVE-2026-14364

  TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'

  Critical 9.8

• CVE-2026-61951

  WordPress TrueBooker plugin <= 1.2.3 - Privilege Escalation vulnerability

  Critical 9.8

• CVE-2026-61950

  WordPress TrueBooker plugin <= 1.2.3 - SQL Injection vulnerability

  Critical 9.3

• CVE-2026-48881

  WordPress TrueBooker plugin <= 1.1.9 - Broken Access Control vulnerability

  Critical 9.1

• CVE-2026-13161

  TrueBooker <= 1.2.2 - Unauthenticated SQL Injection

  High 7.5

• CVE-2026-39663

  WordPress TrueBooker plugin <= 1.1.5 - Broken Access Control vulnerability

  Medium 5.3

• CVE-2026-1797

  Truebooker - Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files

  Medium 5.3

• CVE-2025-67581

  WordPress TrueBooker plugin <= 1.1.0 - Broken Access Control vulnerability

  Medium 5.3

• CVE-2025-47543

  WordPress TrueBooker plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) Vulnerability

  Medium 4.3