CVE-2026-94228 — TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite via admin_setting_setup_data

CVE-2026-94228

TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite via admin_setting_setup_data PUBLISHED

Description (CNA)

The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire configuration and to discard any setting they do not supply.

Affected (CNA)

Vendor / product	Versions
Unknown / TrueBooker	affected 1.1.9 before 1.3.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/fda8b7cb-2e7b-4aa1-9d9e-c6d93bf47332/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.