EUVD-2026-54367
GHSA-g634-mqw6-9p22
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote reset of arbitrary passwords with no interaction (AV:N/AC:L/PR:N/UI:N); admin takeover yields full confidentiality, integrity, and availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The TrueBooker - Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity before resetting their password. This makes it possible for unauthenticated attackers to reset the password of arbitrary user accounts, including administrators, and gain access to those accounts.
AnalysisAI
Account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1.2.3) lets unauthenticated attackers reset the password of any account, including administrators, because the plugin's password-reset flow never verifies the requester's identity. Successful exploitation yields full control of the targeted account and, via an admin takeover, the entire WordPress site. No public exploit identified at time of analysis, but the CVSS 9.8 rating and trivial network exploitability make this a high-priority patch.
Technical ContextAI
TrueBooker is a commercial WordPress appointment-booking/scheduling plugin published by ThemeTechMount (CPE cpe:2.3:a:themetechmount:truebooker_-_appointment_booking_and_scheduler_system). The root cause is CWE-640 (Weak Password Recovery Mechanism for Forgotten Password): the plugin implements its own password-reset endpoint but fails to bind the reset action to a verified secret such as a cryptographically random, single-use reset token tied to the specific user. Because identity is never confirmed before the new password is written, an attacker can supply an arbitrary target user identifier and set a password of their choosing, bypassing WordPress's normal reset-key validation entirely.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - the corrective changeset is published at https://plugins.trac.wordpress.org/changeset/3595807/truebooker-appointment-booking, so update the TrueBooker plugin to the first release built after changeset 3595807 (verify the exact tagged version in the WordPress plugin directory before relying on it, as an exact fix version was not provided). If patching cannot be done immediately, deactivate and remove the TrueBooker plugin until an updated version is confirmed, since the reset endpoint is reachable without authentication; alternatively, restrict access to the plugin's password-reset endpoint at the web server or WAF layer and monitor for unexpected password-reset requests and admin logins, accepting that WAF rules may not cover all request variants and that disabling the plugin removes booking functionality. Review the wp_users table and admin accounts for unauthorized password changes, and rotate administrator credentials as a precaution. Consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/f441477e-35b8-42ae-b71c-3fdba126021b) for detailed guidance.
Account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1
Unauthenticated account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all ve
Unauthenticated attackers can directly access view PHP files in the Truebooker WordPress plugin (versions up to 1.1.4) t
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today