Medium severity5.3NVD Advisory· Published Oct 19, 2026
CVE-2026-94230
CVE-2026-94230
Description
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer accounts.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <1.3.0
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.