Filtered by vendor Wordpress-extensions Subscriptions
Filtered by product Truebooker Subscriptions
Total 5 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-94228 1 Wordpress-extensions 1 Truebooker 2026-10-19 5.3 Medium
The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire configuration and to discard any setting they do not supply.
CVE-2026-94229 1 Wordpress-extensions 1 Truebooker 2026-10-19 5.3 Medium
The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as invalidate the customer's own confirmation link.
CVE-2026-94230 1 Wordpress-extensions 1 Truebooker 2026-10-19 5.3 Medium
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer accounts.
CVE-2026-94231 1 Wordpress-extensions 1 Truebooker 2026-10-19 5.3 Medium
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices.
CVE-2026-39798 2 Themetechmount, Wordpress-extensions 2 Truebooker, Truebooker 2026-10-07 6.5 Medium
Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions.