Truebooker
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:truebooker:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Truebooker (bef80067-3d7e-546d-b5d8-e4d440abb6a2) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-94228 |
vulnerable | 2026-11-03 10:15:43.675214 |
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite via admin_setting_setup_data
MEDIUM (5.3)
The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire configuration and to discard any setting they do not supply.
Published: 2026-10-19T06:46:17.916Z
Updated: 2026-10-19T09:31:21.057Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-94230 |
vulnerable | 2026-11-03 10:15:43.655574 |
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbitrary Price via Multiple AJAX Actions
MEDIUM (5.3)
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer accounts.
Published: 2026-10-19T06:46:19.199Z
Updated: 2026-10-19T09:31:20.753Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-94229 |
vulnerable | 2026-11-03 10:15:43.575725 |
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via IDOR in 'refappbkd' Parameter
MEDIUM (5.3)
The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as invalidate the customer's own confirmation link.
Published: 2026-10-19T06:46:18.554Z
Updated: 2026-10-19T09:31:20.898Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-94231 |
vulnerable | 2026-11-03 10:15:43.562889 |
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creation and Modification
MEDIUM (5.3)
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices.
Published: 2026-10-19T06:46:19.823Z
Updated: 2026-10-19T09:31:20.610Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6925 |
vulnerable | 2026-06-08 06:58:20.764197 |
TrueBooker < 1.0.3 - Settings Update via CSRF
The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Published: 2024-09-08T06:00:03.340Z
Updated: 2024-09-09T20:52:11.903Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6924 |
vulnerable | 2026-06-08 06:58:20.762916 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.