CVE-2026-94228
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Oct 19, 2026
Vendor
unknown
Description
The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire configuration and to discard any setting they do not supply.