TrueBooker – Appointment Booking and Scheduler System

TrueBooker – Appointment Booking and Scheduler System has 25 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; 24 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 6.8, and the most serious one scores 10.0 out of 10. Severity breakdown: 7 critical and 4 high. 2026 was the busiest year with 21 disclosures.

The most common weakness is Missing Authorization, behind 11 of the records (44%). Other recurring categories include SQL Injection, Authorization Bypass Through User-Controlled Key.

24 of the records (96%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

23 independent researchers contributed these findings, most of them (2) reported by Abdullah Kareem "cyberkareem". TrueBooker – Appointment Booking and Scheduler System is installed on roughly 600 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

01234567891018.03.2024Today10.08.202410.0TrueBooker <= 1.0.3 - Unauthenticated SQL Injection CVSS 10.0 · 10.08.20244.3TrueBooker <= 1.0.2 - Cross-Site Request Forgery to Settings Update CVSS 4.3 · 10.08.202407.05.20254.3TrueBooker <= 1.0.7 - Cross-Site Request Forgery CVSS 4.3 · 07.05.202515.12.20255.3TrueBooker <= 1.1.0 - Missing Authorization CVSS 5.3 · 15.12.202518.02.20265.3TrueBooker <= 1.1.6 - Missing Authorization CVSS 5.3 · 18.02.202630.03.20265.3Truebooker - Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files CVSS 5.3 · 30.03.202602.06.20265.3TrueBooker – Appointment Booking and Scheduler System <= 1.1.9 - Missing Authorization CVSS 5.3 · 02.06.202616.07.20267.5TrueBooker – Appointment Booking and Scheduler System <= 1.2.3 - Unauthenticated SQL Injection CVSS 7.5 · 16.07.202617.07.20269.8TrueBooker – Appointment Booking and Scheduler System <= 1.2.3 - Unauthenticated Privilege Escalation CVSS 9.8 · 17.07.202627.07.20267.5TrueBooker <= 1.2.2 - Unauthenticated SQL Injection CVSS 7.5 · 27.07.202606.08.20269.8TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id' CVSS 9.8 · 06.08.20269.8TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid' CVSS 9.8 · 06.08.202614.08.20269.8TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter CVSS 9.8 · 14.08.202618.08.20269.8TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter CVSS 9.8 · 18.08.202619.08.20267.3TrueBooker – Appointment Booking and Scheduler System <= 1.2.6 - Unauthenticated Privilege Escalation CVSS 7.3 · 19.08.202621.08.20265.3TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Missing Authorization CVSS 5.3 · 21.08.20265.3TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Missing Authorization CVSS 5.3 · 21.08.20265.3TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Unauthenticated Information Exposure CVSS 5.3 · 21.08.20267.3TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Unauthenticated Privilege Escalation CVSS 7.3 · 21.08.202615.09.20269.8TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action CVSS 9.8 · 15.09.202605.10.20265.3TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 - Missing Authorization to Unauthenticated Settings Update CVSS 5.3 · 05.10.202616.10.20265.3TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Missing Authorization CVSS 5.3 · 16.10.20265.3TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Missing Authorization CVSS 5.3 · 16.10.20265.3TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Missing Authorization CVSS 5.3 · 16.10.20265.3TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Information Exposure CVSS 5.3 · 16.10.2026

Strategic Overview

Avg CVSSMedium
6.8/ 10
Patch Coverage96%
Open

1

Fixed

24

Get automatic notifications for all TrueBooker – Appointment Booking and Scheduler System vulnerabilities before they are exploited.

Most severe open issueCVSS 5.3CVE-2026-39798

TrueBooker – Appointment Booking and Scheduler System <= 1.2.9 - Missing Authorization to Unauthenticated Settings Update

Read the full analysis

Vulnerability Records

25 records
2026-10-16 00:00CVE-2026-94230
5.3
Medium
Amity GilmourYes
2026-10-16 00:00CVE-2026-94231
5.3
Medium
Ashok ChapagaiYes
2026-10-16 00:00CVE-2026-94228
5.3
Medium
Mikica IvosevicYes
2026-10-16 00:00CVE-2026-94229
5.3
Medium
Enrico MarcoliniYes
2026-10-05 00:00CVE-2026-39798
5.3
Medium
Abdullah Kareem "cyberkareem"No
2026-09-15 15:09CVE-2026-14349
9.8
Critical
Devlin JenkinsYes
2026-08-21 00:00CVE-2026-18779
5.3
Medium
Erwan LRYes
2026-08-21 00:00CVE-2026-18777
5.3
Medium
Mokksh ParekhYes
2026-08-21 00:00CVE-2026-18778
5.3
Medium
Luka ZimonjicYes
2026-08-21 00:00CVE-2026-18776
7.3
High
Abdullah KareemYes
Showing 1–10 of 25 reports
TrueBooker – Appointment Booking and Scheduler System banner
Latestv1.3.0

TrueBooker – Appointment Booking and Scheduler System

ThemetechMount

Author

ThemetechMount

5.0(14)
100/100
Last Updated
2026-10-12 (16d ago)
Active Installs
600+
Downloads
22,121
Requires WP
6.5+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2024-03-18 (3y ago)

TrueBooker is a powerful yet easy-to-use appointment scheduling system , designed to help individuals and businesses manage bookings efficiently. It offers a clean, professional interface with quick setup and intuitive scheduling controls, allowing you to accept and manage appointment requests directly from your website. Administrators can easily review, approve, or cancel bookings from the WordPress dashboard, ensuring smooth and organized appointment management. ⚠️ Important: Version 1.1.9 and later versions include database structure updates. Please backup your database before updating. Useful Links Official Page || TrueBooker Demos || AI Booking Assistant Demo || Documentation TrueBooker is ideal for: TrueBooker is suitable for a wide range of use cases, including service providers, clinics, consultants and small businesses looking for a reliable booking solution without unnecessary complexity. Health & Wellness Professionals Health and wellness professionals such as doctors, dentists, therapists, nutritionists, physiotherapists, and wellness consultants who schedule patient or client visits. Beauty & Salon Services Beauty and salon services including hair stylists, makeup artists, nail technicians, and beauty professionals offering time-based services. Fitness & Gyms Fitness and training services such as personal trainers, yoga instructors, dance teachers, and fitness coaches who manage individual or group sessions. Maintenance & Repair Services Maintenance and repair services such as electricians, plumbers, mechanics, technicians, and other service providers who visit clients by appointment. Upgrade to PRO & Explore the TrueBooker Roadmap We’re continuously enhancing TrueBooker to provide a powerful and user-friendly appointment booking plugin for WordPress. PRO version is available with additional advanced features. Backend & Frontend Enhancements Premium dashboard UI design (Admin & Frontend) New module integration for extended control Custom brand settings (Company logo & business details) What’s New in TrueBooker ( Pro version ) We continuously enhance TrueBooker to deliver a smoother and more powerful appointment scheduling experience. Here’s what’s new in the latest update: Branch Management & Handler: Manage multiple branches with their own staff, services, and schedules. Assign branch managers to handle bookings and staff, ensuring smooth and accountable operations. Department Management & Handler: Organize services into departments and assign handlers to oversee appointments, staff, and operations for each department. Staff Dashboard: Give staff their own dashboard to manage personal details, assigned services, and schedules for better organization and efficiency. Service Timing & Holidays: Set specific working hours, holidays, and special day-offs for flexible scheduling. Refund Policy & Eligibility: Configure refund rules and eligibility within the plugin. Reschedule & Cancel Appointments: Allow customers and admins to easily modify or cancel bookings. Admin Rescheduling: Enable admins to reschedule appointments directly from the backend. Individual Staff Hours: Define custom working hours and breaks for each staff member. Appointment Filters: Quickly sort and manage appointments using backend filter dropdowns. Dynamic Pricing: Automatically adjust service prices based on duration, rules, or other criteria. Custom Scheduling Status: Create and assign custom status tags (e.g., Pending, Approved, Completed, Cancelled) for clear appointment tracking and management. Secure Payment Methods: Centrally manage currencies, deposits, and tax settings. Support for Local, PayPal, Stripe, and Mollie payments ensures smooth, transparent transactions. Custom Thank-You Page Redirection: Redirect customers to a custom thank-you or confirmation page after booking completion. TrueBooker AI Appointment Booking Assistant Conversational Booking: Let customers interact with an AI-powered assistant to find services and book appointments through a simple chat experience. Smart Service Discovery: Help customers find the right services based on their questions and requirements. Guided Appointment Booking: The AI assistant guides customers through the booking process and helps them schedule appointments. Floating or Inline Chat: Add the AI Booking Assistant as a floating chat widget or display it directly within your website content. Works with TrueBooker: Connect the AI assistant with your existing TrueBooker services and booking setup for a seamless booking experience. Multiple AI Providers: Use supported AI providers through WordPress AI Connectors to power your booking assistant. AI Booking Assistant is available as a separate addon for TrueBooker Pro. Payment Integrations & Addons Multiple Payment Options: Accept payments through Stripe, PayPal, Mollie, Local Pay, Square, Razorpay, Klarna, and PayPal Pro with TrueBooker and its dedicated payment addons. WooCommerce Integration: Connect TrueBooker with WooCommerce and use WooCommerce’s checkout and payment features for your appointment bookings. Make Online Bookings Easy with TrueBooker Shortcode Powered & Easy to Use: No coding needed — easily integrate and manage all your bookings with an intuitive interface. Powerful Scheduling Tools: Set your working hours, breaks, and special days with full control over availability. Unlimited Services: Add and categorize as many services and sub-services as you like for customer convenience. Responsive & Customizable Design: Mobile- and desktop-friendly booking forms that you can style to match your brand. Seamless Website Integration: Embed TrueBooker effortlessly and let customers book through an interactive booking wizard. Core Functionality (For Pro version) TrueBooker offers essential tools to manage appointments, staff, services, and notifications, providing a seamless scheduling experience for any business. Tax: Automatically calculate taxes during appointment scheduling. Invoice: Create and send invoices for booked appointments. Cart: Treat appointments like cart items for an easy checkout process. Deposit Payment: Allow down payments to confirm bookings. Staff Member Selection: Let customers choose their preferred staff. Extra Services: Bundle multiple services into one booking. Multi-Booking: Schedule multiple appointments in one session. Holiday Setting: Block specific days/holidays to avoid bookings. Special Day Pricing: Set custom pricing for holidays or special events. Custom Service Duration: Adjust service length and pricing as needed. Custom Scheduling Status: Add custom tags/statuses to appointments. Rescheduling: Allow customers to change appointment date/time. Appointment Analytics: Track and analyze booking trends and performance. Payment Gateways: Support secure online payments through multiple gateways. And much more… Unlock PRO features with TrueBooker Booking PRO. Explore the full list of TrueBooker Booking features. To display the booking form Elementor Widget: Drag and drop the TrueBooker Booking Form widget into your page. Gutenberg Block: Add the TrueBooker Booking Form block from the block editor. Shortcode: Use the shortcode below in any page or post – [truebooker-bookingform] Key Benefits TrueBooker Booking makes appointment scheduling and online bookings easy and painless for both business owners and their customers. Flexible Scheduling: Fully customizable scheduling options with unlimited services, sub services, business hours. Simple Administration: Straightforward but feature-filled administration in the backend. Easy set-up and configuration: Booking form integration with shortcodes easily integrated with popular page builders like Elementor, WPBakery, or Gutenberg blocks No coding required: No need to touch a single line of code. Everything can be done from the backend. Professional Design: Clean and modern & responsive design that looks great on all devices. Extensive Documentation: detailed documentation to guide you trough the setup and all the features. Free version available: Most features are available in the free version of plugin. The Premium version is a great upgrade if you need some more features and flexibility. Great support: Quick and helpful support if you should ever need it.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C