---
id: CVE-2026-94228
title: >-
  TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings
  Overwrite via admin_setting_setup_data
summary: >-
  The TrueBooker WordPress plugin before 1.3.0 does not perform any capability
  check on one of its setup handlers, and the token it does check is issued to
  unauthenticated visitors, allowing anyone to overwrite the plugin's entire
  configur…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-862
product: TrueBooker
affected:
  - TrueBooker >= 1.1.9 < 1.3.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-19T09:25:52.674709Z'
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T09:31:21.057Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-94228'
references:
  - url: 'https://wpscan.com/vulnerability/fda8b7cb-2e7b-4aa1-9d9e-c6d93bf47332/'
tags:
  - cve.org
ingestedAt: '2026-10-19T07:09:59.590Z'
---

## Overview

The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire configuration and to discard any setting they do not supply.

## Affected

- `TrueBooker >= 1.1.9 < 1.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.