CVE-2026-94229 TrueBooker CVE debrief

Who should care

Defenders of WordPress installations using the TrueBooker plugin should assess exposure and verify the plugin version. Security teams and administrators responsible for WordPress deployments need to prioritize verification and potential remediation.

Why it matters

CVE-2026-94229 allows unauthenticated attackers to access sensitive customer information and enumerate booking identifiers in WordPress installations using the TrueBooker plugin before version 1.3.0. Defenders should assess exposure, verify plugin versions, and restrict access to booking confirmation summaries.

• Unauthenticated attackers can access sensitive customer information
• Enumeration of booking identifiers is possible
• Invalidation of customer confirmation links can occur
• Verification of plugin version and exposure is required

Technical summary

The TrueBooker WordPress plugin before 1.3.0 is vulnerable to information disclosure. Unauthenticated attackers can exploit this to enumerate booking identifiers and access personal information of customers who booked appointments. The plugin fails to verify that the requester owns a booking before rendering its confirmation summary. This vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. Defenders should assess exposure, verify plugin versions, and restrict access to booking confirmation summaries. The CVE record was published on 2026-10-19T07:16:32.450Z and has not been modified since then.

Defensive priority

Assess exposure of WordPress installations using the TrueBooker plugin

Recommended defensive actions

• Inventory WordPress installations for the TrueBooker plugin
• Verify plugin version is 1.3.0 or later
• Restrict access to booking confirmation summaries
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary. This allows unauthenticated attackers to enumerate booking identifiers and retrieve personal information of customers who booked an appointment, as well as invalidate the customer's own confirmation link.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.