{"id":"CVE-2026-94230","published":"2026-10-19T07:16:32.580","lastModified":"2026-10-19T21:02:51.987","description":"The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer accounts.","cvssScore":5.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/05881cde-313e-47d5-a176-2b0b0051bca9/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}