CVE-2026-94230 TrueBooker CVE debrief

Who should care

Defenders responsible for WordPress installations using the TrueBooker plugin should assess exposure and prioritize updating the plugin to version 1.3.0 or later. They should also review existing bookings for potential anomalies and implement additional monitoring for suspicious booking activity. This includes security teams, vulnerability management teams, and operators responsible for maintaining WordPress installations.

Why it matters

The vulnerability in the TrueBooker WordPress plugin allows unauthenticated users to create bookings at arbitrary prices and attach them to any customer account, requiring defenders to verify and update the plugin, review existing bookings, and implement additional monitoring.

• Potential unauthorized booking creation at arbitrary prices
• Possible attachment of bookings to arbitrary customer accounts
• Need for verification of existing bookings for anomalies
• Priority for updating the TrueBooker WordPress plugin

Technical summary

The TrueBooker WordPress plugin before 1.3.0 does not have authorization checks in some of its AJAX actions and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer accounts. This vulnerability requires defenders to assess exposure and prioritize updating the plugin to version 1.3.0 or later, and to review existing bookings for potential anomalies. The vulnerability is considered medium severity with a CVSS score of 5.3.

Defensive priority

Defenders should prioritize verifying and updating the TrueBooker WordPress plugin to version 1.3.0 or later, and review existing bookings for potential anomalies.

Recommended defensive actions

• Verify and update the TrueBooker WordPress plugin to version 1.3.0 or later
• Review existing bookings for potential anomalies
• Implement additional monitoring for suspicious booking activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability was reported by WPScan, and the CVE record is based on information from the NVD and CVE Program. The evidence provided by WPScan indicates that the TrueBooker WordPress plugin before 1.3.0 is vulnerable to unauthorized booking creation and price manipulation. Defenders should verify the plugin version and review existing bookings for potential anomalies.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.