CVE-2026-14349: TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the email address of arbitrary user accounts, including administrators, which can be leveraged to reset the account's password and gain access to it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: TrueBooker – Appointment Booking and Scheduler Systemto a version that resolves this vulnerability.Fixed in 1.2.3 - Compensating control
Apply an access control compensating measure by restricting or blocking unauthenticated requests to the TrueBooker WordPress AJAX action 'admin_addcustomer' (e.g., deny/allow at a WAF/endpoint level) until the plugin is updated.
Event History
Frequently Asked Questions
Which deployments are exposed?
WordPress sites running the TrueBooker – Appointment Booking and Scheduler System plugin at version 1.2.3 or earlier are affected.
Does exploitation require an account or user interaction?
No. The vulnerability can be exploited by an unauthenticated attacker and does not require user interaction.
What access could an attacker gain?
An attacker can change the email address for arbitrary WordPress user accounts, including administrator accounts. They may then use password-reset functionality to take over the affected account.
What should be done to remediate the issue?
Update the plugin to a version newer than 1.2.3, as the referenced change identifies version 1.2.4 as containing an update to the affected AJAX handling.