---
id: CVE-2026-94231
title: >-
  TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and
  Category Creation and Modification
summary: >-
  The TrueBooker WordPress plugin before 1.3.0 does not have authorisation
  checks in place in some of its functionality, allowing unauthenticated users
  to create and modify booking services and categories, including their prices.
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-862
product: TrueBooker
affected:
  - TrueBooker >= 1.1.9 < 1.3.0
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T06:46:19.823Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-94231'
references:
  - url: 'https://wpscan.com/vulnerability/d90ad3f4-4d58-43bc-8f17-0f6b8dfdde4f/'
tags:
  - cve.org
ingestedAt: '2026-10-19T07:09:59.591Z'
---

## Overview

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices.

## Affected

- `TrueBooker >= 1.1.9 < 1.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.