CVE-2026-18315: TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the adminusercreatecus AJAX handler lacking any authentication or capability check before passing the attacker-supplied truebookerwpuserid parameter directly to wpupdateuser. This makes it possible for unauthenticated attackers to overwrite the email address of any WordPress user — including an administrator — and then complete the standard WordPress lost-password flow to fully take over the targeted account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/truebooker-appointment-booking-and-scheduler-systemto a version that resolves this vulnerability.Fixed in 1.2.6 - Operational
After patching, complete the WordPress lost-password reset flow for any accounts whose email may have been overwritten (including administrators), and verify account security settings.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit the vulnerable AJAX handler. No WordPress account, administrator privileges, or user interaction is required.
What access can an attacker obtain?
An attacker can change the email address of an arbitrary WordPress user, including an administrator. They can then use WordPress's normal lost-password process to reset that user's password and take over the account.
Which installations are affected?
TrueBooker – Appointment Booking and Scheduler System versions up to and including 1.2.6 are affected. The vulnerable handler does not enforce authentication or a capability check.
How can I determine whether an account may have been targeted?
Review WordPress user email-address changes, especially changes affecting administrator accounts, and inspect password-reset activity following those changes. An unexpected email change followed by a lost-password reset is consistent with the described takeover path.