Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2026-18776

TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJAX Actions

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Truebooker Wordpress
Products
Truebooker Wordpress
CVE-2026-18777

TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Arbitrary Appointment Status Change via update_appointment_status

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Truebooker Wordpress
Products
Truebooker Wordpress
CVE-2026-18778

TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Customer PII Disclosure via Multiple AJAX Actions

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the personal information of customers who booked an appointment, including their name, email address, phone number and postal address.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Truebooker Wordpress
Products
Truebooker Wordpress
CVE-2026-18779

TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Appointment and Payment Record Deletion via update_appointment_booked

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Truebooker Wordpress
Products
Truebooker Wordpress
CVE-2026-14545

TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset

The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Truebooker Wordpress
Products
Truebooker Wordpress