CVE-2026-94228: CWE-862 Missing Authorization in TrueBooker

The TrueBooker WordPress plugin before version 1.3.0 contains a missing authorization vulnerability (CWE-862) in one of its setup handlers. The handler does not verify user capabilities properly and relies on a token that is issued to unauthenticated visitors. As a result, an attacker without authentication can overwrite the plugin's entire configuration, discarding any existing settings not supplied in the attack request. This vulnerability has a CVSS 3.1 base score of 5.3, reflecting a network attack vector with low attack complexity, no privileges required, no user interaction, and an impact limited to integrity loss without confidentiality or availability impact.

An unauthenticated attacker can overwrite the entire configuration of the TrueBooker plugin, potentially disrupting its intended operation by discarding existing settings. There is no direct confidentiality or availability impact reported. The integrity of the plugin's configuration is compromised, which may affect the plugin's behavior or security posture.

No official patch or fix information is provided in the available data. Users should upgrade to TrueBooker version 1.3.0 or later once available, as the vulnerability affects versions >=1.1.9 and <1.3.0. Until a fix is confirmed, restrict access to the plugin's setup handlers if possible and monitor for unusual configuration changes. Check the vendor advisory for updates and official remediation guidance.