CVE-2026-18779 in TrueBooker Plugin

摘要

由 MITRE • 2026-08-19

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• 负责: WPScan
• 预定: 2026-08-04
• 披露: 2026-08-19
• 管理: 已接受
• 条目: VDB-392974
• CPE: 准备好
• CWE: CWE-862 (已确认)
• CVSS: 6.5 (VulDB)
• EPSS: 0.00000
• KEV: 否
• 活动: 非常低
• 部门: Hostingprovider

来源

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-18779
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-18779
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-18779/