---
id: CVE-2026-94231
title: >-
  TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and
  Category Creation and Modification
summary: >-
  The TrueBooker WordPress plugin before 1.3.0 does not have authorisation
  checks in place in some of its functionality, allowing unauthenticated users
  to create and modify booking services and categories, including their prices.
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-862
product: TrueBooker
affected:
  - TrueBooker >= 1.1.9 < 1.3.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-19T09:25:35.234721Z'
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T09:31:20.610Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-94231'
references:
  - url: 'https://wpscan.com/vulnerability/d90ad3f4-4d58-43bc-8f17-0f6b8dfdde4f/'
tags:
  - cve.org
ingestedAt: '2026-10-19T07:09:59.591Z'
epss: 0.00182
epssPercentile: 0.07672
---

## Overview

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices.

## Affected

- `TrueBooker >= 1.1.9 < 1.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.