CVE-2026-94230 in TrueBooker Plugin
Summary
by MITRE • 10/19/2026
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer accounts.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in TrueBooker WordPress plugin versions prior to 1.3.0 represents a critical failure in access control and data validation mechanisms within the application's AJAX handling subsystem. This flaw allows unauthenticated attackers to interact with sensitive administrative or user-specific functions without proper authentication credentials, fundamentally undermining the security model of the web application. The absence of authorization checks means that any individual on the internet can invoke specific AJAX endpoints designed for creating bookings, bypassing the standard login requirements typically enforced by WordPress core and plugin architecture. This lack of enforcement is a classic example of broken access control, where the server fails to verify whether the requesting user has the necessary permissions to perform the action being requested.
From a technical perspective, the vulnerability stems from two distinct but compounding issues within the AJAX handlers. First, there are no checks to ensure that the request originates from an authenticated and authorized session. Second, even if access were restricted, the server fails to validate or sanitize the service price parameter submitted by the client. In secure application design, financial values such as prices must always be validated on the server side against a trusted source of truth, such as a database record defining standard rates for services. By trusting the client-supplied value directly, the plugin allows an attacker to manipulate transaction data arbitrarily. This combination creates a scenario where external actors can execute actions that should be restricted and alter financial outcomes in ways not intended by the system administrators or service providers.
The operational impact of this vulnerability is severe, primarily affecting the integrity of booking systems and potentially leading to significant financial loss for businesses relying on TrueBooker. An attacker can create bookings at a price of their choosing, which could range from zero dollars to artificially inflated amounts depending on the specific exploitation goal. If exploited maliciously to set prices to zero or negative values, it effectively allows free services, eroding revenue streams and distorting business analytics. Furthermore, the ability to attach these fraudulent bookings to arbitrary customer accounts introduces a risk of account compromise and data integrity issues. Attackers could use legitimate user identities to mask their activities, making forensic analysis difficult, or they could disrupt service availability by filling up appointment slots with fake reservations associated with real customers, causing confusion and operational inefficiencies for the business staff.
This vulnerability aligns closely with CWE-862, which describes Missing Authorization, as the application fails to enforce proper access controls on sensitive functionality. Additionally, it relates to CWE-915, Improperly Controlled Modification of Dynamically-Determined Object Attributes, because the attacker is able to modify critical data fields like price and customer association through unvalidated input. In terms of offensive security frameworks, this behavior maps to MITRE ATT&CK technique T1078, Valid Accounts, as attackers may leverage valid user credentials if available or exploit the lack thereof to impersonate users, and it also reflects aspects of T1496, Resource Hijacking, by consuming resources through fake bookings. The exploitation path typically involves crafting a POST request to the specific AJAX endpoint with manipulated parameters for price and customer ID, bypassing any frontend security measures that might otherwise deter casual misuse.
Mitigation strategies must focus on immediate patching and enhanced input validation practices. Administrators running affected versions of TrueBooker should upgrade immediately to version 1.3.0 or later, where these authorization checks and server-side validations have been implemented by the developers. For organizations unable to update instantly due to compatibility constraints, temporary mitigations include restricting access to WordPress AJAX endpoints via web application firewall rules that block unauthorized POST requests to known vulnerable paths. It is also advisable to implement strict rate limiting on booking creation functions to prevent automated abuse at scale. Long-term remediation requires adopting a security-first development approach where all user-supplied data, especially financial values and identifiers, are strictly validated against server-side business logic before processing. Regular code audits focusing on access control lists and input validation can help identify similar vulnerabilities in other plugins or custom modules within the WordPress ecosystem.