TrueBooker

TrueBooker Security Releases - October 2026

truebooker-2026-10 Oct 1, 2026 Source: Vendor

TrueBooker security advisories for October 2026, compiled from CVE.org records.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.cve.org/CVERecord?id=CVE-2026-94228

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

6 lines

Showing 1–6 of 6

CVE-2026-94228 BR2026-0000-037855 TrueBooker unclaimed

The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone t...

Credited as Mikica Ivosevic

CVE-2026-94229 BR2026-0000-037856 TrueBooker unclaimed

The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking ide...

Credited as Enrico Marcolini

CVE-2026-94229 BR2026-0000-037857 TrueBooker unclaimed

Credited as Claudio Marchesini

CVE-2026-94229 BR2026-0000-037858 TrueBooker unclaimed

Credited as Dottor Marc

CVE-2026-94230 BR2026-0000-037859 TrueBooker unclaimed

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated ...

Credited as Amity Gilmour

CVE-2026-94231 BR2026-0000-037860 TrueBooker unclaimed

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categ...

Credited as Ashok Chapagai