Is CVE-2026-94231 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-94231 being exploited in the wild.

How severe is CVE-2026-94231?

Medium severity, with a CVSS score of 5.3, published 19 October 2026.

Which products and versions are affected?

TrueBooker Appointment Booking 1.1.9 to 1.2.9.

Is there a fix for CVE-2026-94231?

Yes: fixed in 1.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-94231 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-94231?

Check whether you run TrueBooker Appointment Booking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-94231: TrueBooker WordPress plugin authorization bypass in service creation

CVE-2026-94231 · Severity: medium · CVSS 5.3 · Published 2026-10-19

TrueBooker is a WordPress plugin that manages appointment bookings and services. The plugin fails to verify user permissions when creating or modifying booking services and categories, allowing anyone to add, change, or delete services and their prices without logging in. An attacker could manipulate booking availability and pricing, disrupting the business operations of sites using this plugin.

Technologies: TrueBooker Appointment Booking. Vendors: TrueBooker.

Quick answers

Is CVE-2026-94231 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-94231 being exploited in the wild.
How severe is CVE-2026-94231?: Medium severity, with a CVSS score of 5.3, published 19 October 2026.
Which products and versions are affected?: TrueBooker Appointment Booking 1.1.9 to 1.2.9.
Is there a fix for CVE-2026-94231?: Yes: fixed in 1.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-94231 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-94231?: Check whether you run TrueBooker Appointment Booking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.3.0

Technical details

The plugin lacks authorization checks (CWE-862) in AJAX endpoints and form handlers for service and category management, allowing unauthenticated POST requests to create and modify booking data. An attacker can send direct HTTP requests to these endpoints without authentication or CSRF tokens to alter services, categories, and pricing information. A fix is available in version 1.3.0.

Affected products

TrueBooker TrueBooker Appointment Booking 1.1.9 to 1.2.9

Timeline

2026-10-16: disclosed
2026-10-19: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.