CVE-2026-18778— TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Customer PII Disclosure via Multiple AJAX Actions
Quick assessment
Affected
Unknown TrueBooker
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
TrueBooker WordPress 插件在 1.2.7 版本之前，在其部分 AJAX 操作中缺乏适当的授权检查，导致未认证的用户可以获取已预约客户的个人信息，包括姓名、电子邮件地址、电话号码和邮政地址。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | TrueBooker | < 1.2.7 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-18778
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Customer PII Disclosure via Multiple AJAX Actions
Source: CVE Program / CVE List V5
Vulnerability Description
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the personal information of customers who booked an appointment, including their name, email address, phone number and postal address.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | TrueBooker | 0 ~ 1.2.7 | - |
|
II. Public POCs for CVE-2026-18778
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-18778
请登录查看更多情报信息。
News Coverage for CVE-2026-18778 (1)
-
🔗 TrueBooker Appointment Booking < 1.2.7 – Unauthenticated Customer PII Disclosure via Multiple AJAX Actions | CVE 2026-18778 | Plugin Vulnerabilities exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-08-19 · 38 CVEs total
| CVE-2026-18779 | TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Appointment and Payment Record De | |
| CVE-2026-18031 | TabaPay Gateway <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback | |
| CVE-2026-17565 | Animation Addons for Elementor < 2.7.2 - Unauthenticated Server-Side Request Forgery | |
| CVE-2026-18466 | WP Maps < 4.9.8 - Subscriber+ Unlimited Autoloaded Option Creation | |
| CVE-2026-18051 | W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Ove | |
| CVE-2026-18231 | WP Directory Kit < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user | |
| CVE-2026-18202 | JetEngine < 3.8.14 - Author+ Stored XSS via SVG Upload | |
| CVE-2026-18776 | TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJA | |
| CVE-2026-18777 | TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Arbitrary Appointment Status Chan | |
| CVE-2026-18937 | Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection | |
| CVE-2026-16979 | SmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key En | |
| CVE-2026-19055 | ProSolution WP Client < 2.0.11 - Reflected XSS via Multiple Parameters | |
| CVE-2026-19709 | Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consu | |
| CVE-2026-19056 | ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter | |
| CVE-2026-19416 | KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR | |
| CVE-2026-19406 | Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appoint | |
| CVE-2026-19417 | KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR | |
| CVE-2026-19782 | WPS Bidouille < 1.33.5 - Subscriber+ User Email Disclosure via wps_get_users | |
| CVE-2026-19842 | SAML Single Sign On 4.8.85 - 5.4.6 - Unauthenticated Administrator Account Takeover via SA | |
| CVE-2026-14334 | Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SV |
Showing top 20 of 38 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: TrueBooker
-
CVE-2026-73347
WordPress TrueBooker plugin <= 1.2.6 - Privilege Escalation -
CVE-2026-18776
TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Acc -
CVE-2026-18777
TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Arb -
CVE-2026-18779
TrueBooker Appointment Booking < 1.2.7 - Unauthenticated App -
CVE-2026-14545
TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Acc
Same vendor: Unknown
-
CVE-2026-78572
Kalles Addons <= 1.0.6 - Unauthenticated PHP Object Injectio -
CVE-2026-77115
Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS -
CVE-2026-77116
Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup -
CVE-2026-77003
Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capabilit -
CVE-2026-14853
WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Pr
V. Comments for CVE-2026-18778
No comments yet