CVE-2026-16142: TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter
The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the addfrontuserupdate() AJAX handler being registered for unauthenticated users and accepting an arbitrary truebookerwpuserid value, which is passed directly to wpupdateuser() without verifying authentication or ownership. This makes it possible for unauthenticated attackers to change any WordPress user account email address, including an administrator, by submitting the target user ID and an attacker-controlled email address. An attacker can then use the native WordPress password reset flow to receive the reset link at the attacker-controlled email address and take over the account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress TrueBooker pluginto a version that resolves this vulnerability.Fixed in 1.2.6 - Configuration
Update the TrueBooker plugin so the add_front_user_update() AJAX handler is not registered for unauthenticated users (i.e., require authentication before handling requests).
WordPress TrueBooker plugin AJAX handler registration for add_front_user_update() = authenticated-only - Configuration
Modify the add_front_user_update() handler to verify authentication and that the requesting user owns (or is authorized for) the truebooker_wp_user_id before calling wp_update_user().
WordPress TrueBooker plugin truebooker_wp_user_id parameter handling = validate ownership
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16142?
CVE-2026-16142 has a critical severity rating of 9.8.
What is the risk associated with CVE-2026-16142?
The risk level for CVE-2026-16142 is classified as high at 86.
How do I fix CVE-2026-16142?
To mitigate CVE-2026-16142, upgrade the TrueBooker plugin to a version later than 1.2.6.
What type of vulnerability is CVE-2026-16142?
CVE-2026-16142 is an Unauthenticated Account Takeover vulnerability via an Insecure Direct Object Reference.
Which software is affected by CVE-2026-16142?
CVE-2026-16142 affects the TrueBooker plugin for WordPress in all versions up to and including 1.2.6.