TrueBooker vulnerabilities
We track 3 vulnerabilities in TrueBooker products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 19, 2026.
Latest TrueBooker vulnerabilities
- 9.8 Critical severity
TrueBooker: Improper Access Control
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their accoun
- 9.8 Critical severity
TrueBooker: Improper Privilege Management
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an admini
- 9.8 Critical severity
TrueBooker: Improper Neutralization of Special Elements used in an SQL Command
The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.