CVE-2026-18777
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The TrueBooker WordPress plugin before 1.2.7 lacks proper authorization checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments and trigger notification emails to affected customers.
Risk Assessment
An attacker can manipulate appointment statuses, leading to schedule chaos and sending false notifications to customers.
Recommendation
Update the TrueBooker plugin to version 1.2.7 or later to fix the missing authorization.
Original NVD description (English source)
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers.