ThemetechMount TrueBooker – Appointment Booking and Scheduler System

• CVE-2026-14349 Critical 9.8 TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action 0.6%
• CVE-2026-18315 Critical 9.8 TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter 3.0%
• CVE-2026-16142 Critical 9.8 TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter 0.7%
• CVE-2026-14364 Critical 9.8 TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid' 0.5%
• CVE-2026-14365 Critical 9.8 TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id' 0.6%
• CVE-2026-13161 High 7.5 TrueBooker <= 1.2.2 - Unauthenticated SQL Injection 0.8%
• CVE-2026-1797 Medium 5.3 Truebooker - Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files 0.2%