Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,080 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?Booking CalendarAmeliaSalon booking systemAppointment BookingBooklyE4J s.R.LWP Hotel BookingTrueBooker
Plugin · truebooker-appointment-booking
TrueBooker
26 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 19, 2026TrueBooker: Does not have authorisation checks in place in some of its functionalityCVE-2026-94231 · fixed in 1.3.0 · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices.
Oct 19, 2026TrueBooker: Does not have authorisation checks in some of its AJAX actionsCVE-2026-94230 · fixed in 1.3.0 · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer accounts.
Oct 19, 2026TrueBooker: Does not verify that the requester owns a booking before rendering its confirmation summaryCVE-2026-94229 · fixed in 1.3.0 · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as invalidate the customer's own confirmation link.
Oct 19, 2026TrueBooker: Does not perform any capability check on one of its setup handlersCVE-2026-94228 · fixed in 1.3.0 · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire configuration and to discard any setting they do not supply.
Oct 6, 2026Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions.CVE-2026-39798 · affects up to 1.2.9 · reported by PatchstackMedium 6.5
Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions.
Sep 16, 2026TrueBooker – Appointment Booking and Scheduler System: Authorization bypassCVE-2026-14349 · affects up to 1.2.3 · reported by WordfenceCritical 9.8
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the email address of arbitrary user accounts, including administrators, which can be leveraged to reset the account's password and gain access to it.
Aug 19, 2026TrueBooker – Appointment Booking and Scheduler System: Authorization Bypass Through User-Controlled Key leading to Account TakeoverCVE-2026-18315 · affects up to 1.2.6 · reported by WordfenceCritical 9.8
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the admin_user_create_cus AJAX handler lacking any authentication or capability check before passing the attacker-supplied truebooker_wp_user_id parameter directly to wp_update_user. This makes it possible for unauthenticated attackers to overwrite the email address of any WordPress user — including an administrator — and then complete the standard WordPress lost-password flow to fully take over the targeted account.
NVD recordplugins.svn.wordpress.orgplugins.svn.wordpress.org
Aug 19, 2026Unauthenticated Privilege Escalation in TrueBooker <= 1.2.6 versions.CVE-2026-73347 · affects up to 1.2.6 · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in TrueBooker <= 1.2.6 versions.
Aug 19, 2026TrueBooker: Does not have proper authorisation checks in one of its AJAX actionsCVE-2026-18779 · fixed in 1.2.7 · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records.
Aug 19, 2026TrueBooker: Does not have proper authorisation checks in some of its AJAX actionsCVE-2026-18778 · fixed in 1.2.7 · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the personal information of customers who booked an appointment, including their name, email address, phone number and postal address.
Aug 19, 2026TrueBooker: Does not have proper authorisation checks in one of its AJAX actionsCVE-2026-18777 · fixed in 1.2.7 · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers.
Aug 19, 2026TrueBooker: Does not have proper authorisation checks in some of its AJAX actionsCVE-2026-18776 · fixed in 1.2.7 · reported by WPScanCritical 9.8
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.
Aug 15, 2026TrueBooker: Account TakeoverCVE-2026-16142 · affects up to 1.2.6 · reported by WordfenceCritical 9.8
The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() AJAX handler being registered for unauthenticated users and accepting an arbitrary truebooker_wp_user_id value, which is passed directly to wp_update_user() without verifying authentication or ownership. This makes it possible for unauthenticated attackers to change any WordPress user account email address, including an administrator, by submitting the target user ID and an attacker-controlled email address. An attacker can then use the native WordPress password reset flow to receive the reset link at the attacker-controlled email address and take over the account.
Aug 7, 2026TrueBooker – Appointment Booking and Scheduler System: Authorization bypassCVE-2026-14365 · affects up to 1.2.3 · reported by WordfenceCritical 9.8
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to change the password of arbitrary user accounts, including administrators, which can be leveraged to gain access to those accounts.
Aug 7, 2026TrueBooker – Appointment Booking and Scheduler System: Account takeoverCVE-2026-14364 · affects up to 1.2.3 · reported by WordfenceCritical 9.8
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity before resetting their password. This makes it possible for unauthenticated attackers to reset the password of arbitrary user accounts, including administrators, and gain access to those accounts.
Jul 28, 2026TrueBooker – Appointment Booking and Scheduler System: Generic SQL InjectionCVE-2026-13161 · affects up to 1.2.2 · reported by WordfenceHigh 7.5
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldata[truebooker_user]' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The check_ajax_referer() nonce guard does not constitute an authentication or authorization barrier because the nonce is exposed to unauthenticated visitors on TrueBooker front-end booking pages; exploitation additionally requires that the required booking fields (category, service, person, date, and time slot) be present in the alldata POST parameter so that execution reaches the vulnerable SQL query branch.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 28, 2026TrueBooker: Does not validate account ownershipCVE-2026-14545 · fixed in 1.2.4 · reported by WPScanCritical 9.8
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.
Jul 23, 2026Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions.CVE-2026-61951 · affects up to 1.2.3 · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions.
Jul 23, 2026Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions.CVE-2026-61950 · affects up to 1.2.3 · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions.
Jun 15, 2026Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions.CVE-2026-48881 · affects up to 1.1.9 · reported by PatchstackCritical 9.1
Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions.
Apr 8, 2026TrueBooker: Missing AuthorizationCVE-2026-39663 · affects up to 1.1.5 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TrueBooker: from n/a through <= 1.1.5.
Mar 31, 2026Appointment Booking and Scheduler Plugin – Truebooker: Sensitive Information ExposureCVE-2026-1797 · affects up to 1.1.4 · reported by WordfenceMedium 5.3
The Appointment Booking and Scheduler Plugin – Truebooker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 through views php files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed views php files via direct access.
Dec 9, 2025TrueBooker: Missing AuthorizationCVE-2025-67581 · affects up to 1.1.0 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TrueBooker: from n/a through <= 1.1.0.
May 7, 2025TrueBooker: Cross-Site Request Forgery (CSRF)CVE-2025-47543 · affects up to 1.0.7 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Cross Site Request Forgery.This issue affects TrueBooker: from n/a through <= 1.0.7.
Sep 8, 2024TrueBooker: Does not have CSRF check in placeCVE-2024-6925 · fixed in 1.0.3 · reported by WPScanMedium 4.3
The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Sep 8, 2024TrueBooker: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6924 · fixed in 1.0.3 · reported by WPScanCritical 9.8
The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.