Unknown Truebooker vulnerabilities

5 CVEs affecting Unknown Truebooker, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-18779, published 2026-08-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-18776, published 2026-08-19. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users,…
CVE-2026-14545, published 2026-07-28. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to…
CVE-2026-18778, published 2026-08-19. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the personal information of customers…
CVE-2026-18779, published 2026-08-19. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with…
CVE-2026-18777, published 2026-08-19. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as…