CVE-2024-6924critical

CVE-2024-6924: critical vulnerability in TrueBooker

TrueBooker < 1.0.3 - Multiple Unauthenticated SQLi

Published · Updated

Follow this CVE+ Monitor TrueBooker

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.8epss 3.3%
The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · TrueBooker
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — TrueBooker

In the same product, most dangerous first.

CVE-2026-18776CRITICALTrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJAX ActionsEPSS 0.5%CVE-2026-14545CRITICALTrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password ResetEPSS 0.5%CVE-2026-18778MEDIUMTrueBooker Appointment Booking < 1.2.7 - Unauthenticated Customer PII Disclosure via Multiple AJAX ActionsEPSS 0.3%CVE-2026-18779MEDIUMTrueBooker Appointment Booking < 1.2.7 - Unauthenticated Appointment and Payment Record Deletion via update_appointment_bookedEPSS 0.3%CVE-2026-18777MEDIUMTrueBooker Appointment Booking < 1.2.7 - Unauthenticated Arbitrary Appointment Status Change via update_appointment_statusEPSS 0.3%CVE-2024-6925MEDIUMTrueBooker < 1.0.3 - Settings Update via CSRFEPSS 0.2%