Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: TrueBooker 1.2.7 Clear all filters
TI-2026-15383 CVE-2026-18779 · GHSA-47hm-j4wc-4fjq

Missing authorization in TrueBooker

Priority LOW 30

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated bookin…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00304 Published 2026-08-19 Fixed in 1.2.7 CWE-862
TI-2026-15382 CVE-2026-18778 · GHSA-gppp-m845-93gc

TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Customer PII Disclosure via Multiple AJAX Actions

Priority LOW 30

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the personal information of customers who booked an appointme…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00345 Published 2026-08-19 Fixed in 1.2.7 CWE-200
TI-2026-15381 CVE-2026-18777 · GHSA-8fxq-m46w-rjrf

Missing authorization in TrueBooker

Priority LOW 30

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger noti…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00304 Published 2026-08-19 Fixed in 1.2.7 CWE-862
TI-2026-15380 CVE-2026-18776 · GHSA-ww49-2fhh-98x8

TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJAX Actions

Priority MEDIUM 49

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators,…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00498 Published 2026-08-19 Fixed in 1.2.7 CWE-284