Is CVE-2026-94230 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-94230?

CVE-2026-94230 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-94230

Description

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer accounts.