CVE-2026-18779 — TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Appointment and Payment Record Deletion via update_appointment_booked
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointmen…
Published: 2026-08-19 · CVSS: 5.3 · CVSS 3.1
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7