Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-16
TrueBooker - Security Vulnerability (CVE-2026-14349)
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the email address of arbitrary user accounts, including administrators, which can be leveraged to reset the account's password and gain access to it.
PLUGIN
TrueBooker
CVE-2026-14349
Risk Score
Threat Entry
Updated 2026-08-21
TrueBooker - Broken Access Control (CVE-2026-18315)
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the admin_user_create_cus AJAX handler lacking any authentication or capability check before passing the attacker-supplied truebooker_wp_user_id parameter directly to wp_update_user. This makes it possible for unauthenticated attackers to overwrite the email address of any WordPress user — including an administrator — and then complete the standard WordPress lost-password flow to fully take over the targeted account.
PLUGIN
TrueBooker
CVE-2026-18315
Risk Score
Threat Entry
Updated 2026-08-20
TrueBooker - Privilege Escalation (CVE-2026-73347)
Unauthenticated Privilege Escalation in TrueBooker
THEME
TrueBooker
CVE-2026-73347
Risk Score
Threat Entry
Updated 2026-11-09
TrueBooker - Security Vulnerability (CVE-2026-18779)
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records.
PLUGIN
TrueBooker
CVE-2026-18779
Risk Score
Threat Entry
Updated 2026-11-09
TrueBooker - Security Vulnerability (CVE-2026-18778)
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the personal information of customers who booked an appointment, including their name, email address, phone number and postal address.
PLUGIN
TrueBooker
CVE-2026-18778
Risk Score
Threat Entry
Updated 2026-11-09
TrueBooker - Security Vulnerability (CVE-2026-18777)
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers.
PLUGIN
TrueBooker
CVE-2026-18777
Risk Score
Threat Entry
Updated 2026-11-09
TrueBooker - Security Vulnerability (CVE-2026-18776)
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.
PLUGIN
TrueBooker
CVE-2026-18776
Risk Score
Threat Entry
Updated 2026-08-20
TrueBooker - Security Vulnerability (CVE-2026-16142)
The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() AJAX handler being registered for unauthenticated users and accepting an arbitrary truebooker_wp_user_id value, which is passed directly to wp_update_user() without verifying authentication or ownership. This makes it possible for unauthenticated attackers to change any WordPress user account email address, including an administrator, by submitting the target user ID and an attacker-controlled email address. An attacker can then use the native WordPress password reset flow to receive…
PLUGIN
TrueBooker
CVE-2026-16142
Risk Score
Threat Entry
Updated 2026-08-12
TrueBooker - Broken Access Control (CVE-2026-14365)
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to change the password of arbitrary user accounts, including administrators, which can be leveraged to gain access to those accounts.
PLUGIN
TrueBooker
CVE-2026-14365
Risk Score
Threat Entry
Updated 2026-08-12
TrueBooker - Security Vulnerability (CVE-2026-14364)
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity before resetting their password. This makes it possible for unauthenticated attackers to reset the password of arbitrary user accounts, including administrators, and gain access to those accounts.
PLUGIN
TrueBooker
CVE-2026-14364
Risk Score
Threat Entry
Updated 2026-07-28
TrueBooker - SQL Injection (CVE-2026-13161)
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldata[truebooker_user]' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The check_ajax_referer() nonce guard does not constitute an authentication or authorization barrier because the nonce…
PLUGIN
TrueBooker
CVE-2026-13161
Risk Score
Threat Entry
Updated 2026-07-28
TrueBooker - Improper Input Validation (CVE-2026-14545)
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.
PLUGIN
TrueBooker
CVE-2026-14545
Risk Score
Threat Entry
Updated 2026-07-23
TrueBooker - Privilege Escalation (CVE-2026-61951)
Unauthenticated Privilege Escalation in TrueBooker
PLUGIN
TrueBooker
CVE-2026-61951
Risk Score
Threat Entry
Updated 2026-07-23
TrueBooker - SQL Injection (CVE-2026-61950)
Unauthenticated SQL Injection in TrueBooker
PLUGIN
TrueBooker
CVE-2026-61950
Risk Score
Threat Entry
Updated 2026-06-17
TrueBooker - Broken Access Control (CVE-2026-48881)
Unauthenticated Broken Access Control in TrueBooker
PLUGIN
TrueBooker
CVE-2026-48881
Risk Score
Threat Entry
Updated 2026-06-17
Truebooker - Cross-Site Request Forgery (CSRF) (CVE-2025-47543)
Cross-Site Request Forgery (CSRF) vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Cross Site Request Forgery.This issue affects TrueBooker: from n/a through
PLUGIN
Truebooker
CVE-2025-47543
Risk Score
Threat Entry
Updated 2026-06-17
Truebooker - SQL Injection (CVE-2024-6924)
The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
PLUGIN
Truebooker
CVE-2024-6924
Risk Score
Threat Entry
Updated 2026-06-17
Truebooker - Cross-Site Request Forgery (CSRF) (CVE-2024-6925)
The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
PLUGIN
Truebooker
CVE-2024-6925
Risk Score