CVSS 5.3 (medium) · published 2026-10-19
The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire configuration and to discard any setting they do not supply.
Weakness: CWE-862
Source: NVD CVE-2026-94228
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.