VULNERABILITY INTELLIGENCE
CVE-2026-18778
CVSS score5.3 MEDIUM
EPSS probability0.34%
CISA KEVNot currently listed
Published2026-08-19
Last modified2026-08-26
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the personal information of customers who booked an appointment, including their name, email address, phone number and postal address.
Weakness classification
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-200