{"cve":{"cve_id":"CVE-2026-18779","is_kev":false,"kev_date_added":null,"kev_vendor_project":null,"kev_product":null,"kev_vulnerability_name":null,"kev_short_description":null,"kev_required_action":null,"kev_due_date":null,"kev_known_ransomware":null,"kev_notes":null,"kev_cwes":null,"epss_score":0.00304,"epss_percentile":0.21553,"epss_as_of":"2026-10-15","description":"The TrueBooker  WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records.","published_at":"2026-08-19T06:00:20.143000Z","last_modified_at":"2026-08-26T16:30:52.723000Z","cvss_v3_score":5.3,"cvss_v3_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_v3_severity":"MEDIUM","cvss_v4_score":null,"cvss_v4_vector":null,"cvss_v4_severity":null,"ssvc_decision":null,"ssvc_exploitation":"none","ssvc_automatable":true,"ssvc_technical_impact":"partial","cwes":["CWE-862"],"nvd_references":["https://wpscan.com/vulnerability/9d7f9a09-a144-4a0a-998c-e5bc5037fc1b/"],"vuln_status":"Deferred","trending_score":null,"is_trending":false,"has_trended":false,"trended_number_one":false,"trending_peak_score":null,"trending_peak_rank":null,"started_trending_at":null,"trended_number_one_at":null,"summary_generated":null,"summary_generated_at":null,"summary_model":null,"created_at":"2026-08-19T06:42:27.512850Z","updated_at":"2026-08-27T18:05:39.505320Z"},"effective_severity":"MEDIUM","badges":[],"impact_analysis":[],"cvss_v3_decoded":{"version":"3.1","metrics":[{"metric":"AV","name":"Attack Vector","value":"N","value_label":"Network"},{"metric":"AC","name":"Attack Complexity","value":"L","value_label":"Low"},{"metric":"PR","name":"Privileges Required","value":"N","value_label":"None"},{"metric":"UI","name":"User Interaction","value":"N","value_label":"None"},{"metric":"S","name":"Scope","value":"U","value_label":"Unchanged"},{"metric":"C","name":"Confidentiality","value":"N","value_label":"None"},{"metric":"I","name":"Integrity","value":"L","value_label":"Low"},{"metric":"A","name":"Availability","value":"N","value_label":"None"}]},"cvss_v4_decoded":{"version":null,"metrics":[]},"affected":[{"vendor_slug":"unknown","vendor_name":"Unknown","product_slug":"truebooker","product_name":"TrueBooker","version_start":"0","version_start_inclusive":true,"version_end":"1.2.7","version_end_inclusive":false,"cpe23_uri":"cve5:unknown:truebooker:0:1.2.7"}],"exploit_refs":[],"news":[],"references":[{"url":"https://wpscan.com/vulnerability/9d7f9a09-a144-4a0a-998c-e5bc5037fc1b/","source_type":"MISC","tags":[]}],"timeline":[{"type":"published","at":"2026-08-19T06:00:20.143000Z","label":"CVE published","source":null},{"type":"cvss_changed","at":"2026-08-19T16:42:27.512792Z","label":"CVSS score revised","source":"cvelistv5"},{"type":"cvss_changed","at":"2026-08-19T16:42:27.512792Z","label":"CVSS score revised","source":"cvelistv5"},{"type":"cvss_changed","at":"2026-08-19T16:42:27.512792Z","label":"CVSS score revised","source":"cvelistv5"},{"type":"ssvc_changed","at":"2026-08-19T18:43:27.514802Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"ssvc_changed","at":"2026-08-19T18:43:27.514802Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"ssvc_changed","at":"2026-08-19T18:43:27.514802Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"cvss_changed","at":"2026-08-19T18:43:27.514802Z","label":"CVSS score revised","source":"vulnrichment"},{"type":"cvss_changed","at":"2026-08-19T18:43:27.514802Z","label":"CVSS score revised","source":"vulnrichment"},{"type":"cvss_changed","at":"2026-08-19T18:43:27.514802Z","label":"CVSS score revised","source":"vulnrichment"}]}