Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 23:06:43 +0000 CVE-2026-18776 — TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJAX Actions https://cve.radiocsirt.org/vuln/cve-2026-18776 <p><strong>Affected:</strong> Unknown TrueBooker</p> <p>The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.</p> <p><strong>Affected:</strong> Unknown TrueBooker</p> <p>The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.</p> https://cve.radiocsirt.org/vuln/cve-2026-18776