Truebooker
Monthly
Unauthenticated privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin versions 1.2.6 and earlier allows a remote attacker with no credentials to elevate their privileges within the WordPress site, per a Patchstack report. The CVSS 9.8 rating (AV:N/AC:L/PR:N/UI:N) reflects fully remote, low-complexity abuse with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Account takeover in TrueBooker WordPress plugin before 1.2.4 enables unauthenticated attackers to reset any user’s password via a front-end handler lacking ownership validation, compromising the entire site. Public proof-of-concept exploit code is available, though EPSS exploitation probability remains low (0.14%) and no CISA KEV listing confirms active exploitation.
Privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin through version 1.2.3 lets unauthenticated remote attackers gain elevated privileges via an incorrect privilege-assignment flaw (CWE-266). With a CVSS 9.8 network/no-auth vector, a successful attacker can escalate to a high-privilege account and fully compromise the affected WordPress site; no public exploit identified at time of analysis and the issue is not in CISA KEV.
Unauthenticated SQL injection in the TrueBooker (truebooker-appointment-booking) WordPress plugin by themetechmount affects all versions up to and including 1.2.3, letting remote attackers inject arbitrary SQL through an exposed plugin parameter without any authentication. Rated CVSS 9.3, it enables extraction of sensitive WordPress database contents (user records, credentials, secrets) and, per the scope-changed CVSS vector, impact reaching beyond the plugin's own security boundary. No public exploit identified at time of analysis and it is not on CISA KEV, but the unauthenticated network vector makes it an attractive automation target.
Unauthenticated broken access control in the TrueBooker WordPress appointment-booking plugin (versions ≤ 1.1.9 by ThemeTechMount) allows remote attackers without credentials to invoke privileged plugin functionality that should be restricted, exposing booking data and permitting unauthorized state changes. The flaw is tracked by Patchstack and rated CVSS 9.1 with network attack vector and no privileges or user interaction required; no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.
Missing authorization checks in the TrueBooker WordPress plugin before 1.3.0 allow unauthenticated remote attackers to create and modify booking services and categories, including their prices. Publicly available exploit code exists, and the assessed CVSS vector indicates integrity-only impact (C:N/I:L/A:N) with no confidentiality or availability effect. This is a moderate-severity broken access control issue requiring only that the vulnerable plugin version be deployed.
Unauthenticated attackers can create TrueBooker bookings at attacker-chosen prices and attach them to arbitrary customer accounts in WordPress plugin versions before 1.3.0 because several AJAX actions lack authorization checks and the service price is not validated server-side. The flaw is medium severity (CVSS 5.3) with integrity-only impact, and publicly available exploit code exists. Exploitation requires the plugin to be installed and active with its booking AJAX actions reachable, which is the default state for core functionality.
TrueBooker, a WordPress booking/appointment plugin, renders a booking confirmation summary without verifying that the requester actually owns the referenced booking, so anyone on the internet can walk booking identifiers and read the confirmation pages of other customers. That exposes customer personal information contained in the summary and also lets an attacker invalidate a victim's own confirmation link (a limited integrity impact on top of the disclosure). All versions before 1.3.0 are affected, no authentication or user interaction is required against a default installation, publicly available exploit code exists, and the issue is rated CVSS 5.3 (Medium) with confidentiality and limited integrity impact only.
TrueBooker, a WordPress plugin, lets unauthenticated remote attackers rewrite its entire stored configuration because one of its setup handlers performs no WordPress capability check and validates only a token that is itself handed out to unauthenticated visitors. Any site running a version before 1.3.0 is affected; no login, no user interaction, and no non-default configuration are required, and publicly available exploit code exists (no CISA KEV entry at time of analysis). Impact is limited to integrity - settings the attacker does not supply are discarded, so the plugin can be left in an attacker-chosen or broken state - with no confidentiality or availability impact reflected in the CVSS 5.3 score, making this a moderate-priority integrity issue rather than a code-execution emergency.
Unauthenticated settings modification in the TrueBooker appointment-booking WordPress plugin (versions 1.2.9 and earlier) lets remote attackers alter plugin configuration without logging in, rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N, meaning no privileges, no user interaction, and low attack complexity are required against default installs. The flaw is a CWE-862 missing authorization condition that affects integrity (limited) and availability (limited) but not confidentiality, so the practical outcome is tampered or degraded booking/settings behaviour rather than data theft or code execution. Exposure is bounded by deployment scope - only WordPress sites running this specific ThemeTechMount plugin at a vulnerable version are at risk - and no public exploit code or confirmed active exploitation was identified at time of analysis; as of the Patchstack report (EUVD-2026-93042) no fixed version had been published.
TrueBooker appointment booking plugin through version 1.1.5 fails to enforce proper authorization controls, allowing unauthenticated remote attackers to modify sensitive data via incorrectly configured access control mechanisms. The vulnerability has a low CVSS score (5.3) reflecting limited direct impact, but represents a critical authentication bypass in a widely deployed WordPress plugin affecting booking system integrity.
Cross-Site Request Forgery (CSRF) vulnerability in themetechmount TrueBooker allows Cross Site Request Forgery.0.7. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin versions 1.2.6 and earlier allows a remote attacker with no credentials to elevate their privileges within the WordPress site, per a Patchstack report. The CVSS 9.8 rating (AV:N/AC:L/PR:N/UI:N) reflects fully remote, low-complexity abuse with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Account takeover in TrueBooker WordPress plugin before 1.2.4 enables unauthenticated attackers to reset any user’s password via a front-end handler lacking ownership validation, compromising the entire site. Public proof-of-concept exploit code is available, though EPSS exploitation probability remains low (0.14%) and no CISA KEV listing confirms active exploitation.
Privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin through version 1.2.3 lets unauthenticated remote attackers gain elevated privileges via an incorrect privilege-assignment flaw (CWE-266). With a CVSS 9.8 network/no-auth vector, a successful attacker can escalate to a high-privilege account and fully compromise the affected WordPress site; no public exploit identified at time of analysis and the issue is not in CISA KEV.
Unauthenticated SQL injection in the TrueBooker (truebooker-appointment-booking) WordPress plugin by themetechmount affects all versions up to and including 1.2.3, letting remote attackers inject arbitrary SQL through an exposed plugin parameter without any authentication. Rated CVSS 9.3, it enables extraction of sensitive WordPress database contents (user records, credentials, secrets) and, per the scope-changed CVSS vector, impact reaching beyond the plugin's own security boundary. No public exploit identified at time of analysis and it is not on CISA KEV, but the unauthenticated network vector makes it an attractive automation target.
Unauthenticated broken access control in the TrueBooker WordPress appointment-booking plugin (versions ≤ 1.1.9 by ThemeTechMount) allows remote attackers without credentials to invoke privileged plugin functionality that should be restricted, exposing booking data and permitting unauthorized state changes. The flaw is tracked by Patchstack and rated CVSS 9.1 with network attack vector and no privileges or user interaction required; no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.
Missing authorization checks in the TrueBooker WordPress plugin before 1.3.0 allow unauthenticated remote attackers to create and modify booking services and categories, including their prices. Publicly available exploit code exists, and the assessed CVSS vector indicates integrity-only impact (C:N/I:L/A:N) with no confidentiality or availability effect. This is a moderate-severity broken access control issue requiring only that the vulnerable plugin version be deployed.
Unauthenticated attackers can create TrueBooker bookings at attacker-chosen prices and attach them to arbitrary customer accounts in WordPress plugin versions before 1.3.0 because several AJAX actions lack authorization checks and the service price is not validated server-side. The flaw is medium severity (CVSS 5.3) with integrity-only impact, and publicly available exploit code exists. Exploitation requires the plugin to be installed and active with its booking AJAX actions reachable, which is the default state for core functionality.
TrueBooker, a WordPress booking/appointment plugin, renders a booking confirmation summary without verifying that the requester actually owns the referenced booking, so anyone on the internet can walk booking identifiers and read the confirmation pages of other customers. That exposes customer personal information contained in the summary and also lets an attacker invalidate a victim's own confirmation link (a limited integrity impact on top of the disclosure). All versions before 1.3.0 are affected, no authentication or user interaction is required against a default installation, publicly available exploit code exists, and the issue is rated CVSS 5.3 (Medium) with confidentiality and limited integrity impact only.
TrueBooker, a WordPress plugin, lets unauthenticated remote attackers rewrite its entire stored configuration because one of its setup handlers performs no WordPress capability check and validates only a token that is itself handed out to unauthenticated visitors. Any site running a version before 1.3.0 is affected; no login, no user interaction, and no non-default configuration are required, and publicly available exploit code exists (no CISA KEV entry at time of analysis). Impact is limited to integrity - settings the attacker does not supply are discarded, so the plugin can be left in an attacker-chosen or broken state - with no confidentiality or availability impact reflected in the CVSS 5.3 score, making this a moderate-priority integrity issue rather than a code-execution emergency.
Unauthenticated settings modification in the TrueBooker appointment-booking WordPress plugin (versions 1.2.9 and earlier) lets remote attackers alter plugin configuration without logging in, rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N, meaning no privileges, no user interaction, and low attack complexity are required against default installs. The flaw is a CWE-862 missing authorization condition that affects integrity (limited) and availability (limited) but not confidentiality, so the practical outcome is tampered or degraded booking/settings behaviour rather than data theft or code execution. Exposure is bounded by deployment scope - only WordPress sites running this specific ThemeTechMount plugin at a vulnerable version are at risk - and no public exploit code or confirmed active exploitation was identified at time of analysis; as of the Patchstack report (EUVD-2026-93042) no fixed version had been published.
TrueBooker appointment booking plugin through version 1.1.5 fails to enforce proper authorization controls, allowing unauthenticated remote attackers to modify sensitive data via incorrectly configured access control mechanisms. The vulnerability has a low CVSS score (5.3) reflecting limited direct impact, but represents a critical authentication bypass in a widely deployed WordPress plugin affecting booking system integrity.
Cross-Site Request Forgery (CSRF) vulnerability in themetechmount TrueBooker allows Cross Site Request Forgery.0.7. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.