Auth bypass in Truebooker
CVE-2026-18777
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers.
Vulnerability class: Broken Access Control
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Unknown Truebooker
Weakness classification (CWE)
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-18777?
- CVE-2026-18777 is a medium-severity vulnerability in Truebooker, classified under Missing Authorization. CVSS score: 5.3/10. Published 2026-08-19.
- How severe is CVE-2026-18777?
- Medium severity. CVSS v3 base score is 5.3 out of 10.