ThemetechMount vulnerabilities
We track 8 vulnerabilities in ThemetechMount products across 3 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on September 16, 2026.
Latest ThemetechMount vulnerabilities
- 9.8 Critical severity
TrueBooker – Appointment Booking and Scheduler…: Missing Authorization
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. T
- 9.8 Critical severity
TrueBooker – Appointment Booking and Scheduler…: Authorization Bypass Through User-Controlled Key
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the admin_user_create_cus A
- 9.8 Critical severity
TrueBooker – Appointment Booking and Scheduler…: Authorization Bypass Through User-Controlled Key
The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() AJAX handler being registered for unauthenticated users and accepting an arbitrary truebooker_wp_user_
- 9.8 Critical severity
TrueBooker – Appointment Booking and Scheduler…: Missing Authorization
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. T
- 9.8 Critical severity
TrueBooker – Appointment Booking and Scheduler…: Weak Password Recovery Mechanism for Forgotten Password
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's iden
- 7.5 High severity
TrueBooker – Appointment Booking and Scheduler…: Improper Neutralization of Special Elements used in an SQL Command
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldata[truebooker_user]' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied par
- 7.5 High severity
Boldman: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemetechMount Boldman boldman allows PHP Local File Inclusion.This issue affects Boldman: from n/a through <= 7.7.
- 9.8 Critical severity
TrueBooker: Improper Neutralization of Special Elements used in an SQL Command
The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.