Improper Authorization in TrueBooker Plugin for WordPress
CVE-2026-18778
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 19 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-18778?
The TrueBooker WordPress plugin prior to version 1.2.7 lacks essential authorization checks in specific AJAX actions. This vulnerability permits unauthorized users to access sensitive customer information, including names, email addresses, phone numbers, and postal addresses, associated with appointments. Consequently, this oversight poses significant privacy risks to users booking through the platform.
Affected Version(s)
TrueBooker 0 < 1.2.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.