EUVD-2026-54364
GHSA-9p7q-wqgp-8mm8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated single-request password reset of any account gives full admin takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H; scope unchanged as impact stays within WordPress.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The TrueBooker - Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to change the password of arbitrary user accounts, including administrators, which can be leveraged to gain access to those accounts.
AnalysisAI
Unauthenticated account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1.2.3) allows remote attackers to reset the password of any account, including administrators, because a password-change action fails to verify the requester's authorization. Successful exploitation yields full admin login and therefore complete control of the WordPress site. No public exploit identified at time of analysis; the flaw was reported by Wordfence and an upstream fix is present in the plugin repository.
Technical ContextAI
The affected component is a WordPress plugin (cpe:2.3:a:themetechmount:truebooker_-_appointment_booking_and_scheduler_system) that adds appointment-booking and scheduling functionality to WordPress sites. The root cause is CWE-862 (Missing Authorization): a plugin-exposed action that changes a user's password does not check that the caller is permitted to modify the target account (no capability check, nonce enforcement, or ownership verification tied to the current user). Because WordPress plugin AJAX/REST handlers are reachable over HTTP, an action lacking these server-side authorization gates can be invoked by any visitor and made to operate on an arbitrary user ID, decoupling the privilege of the requester from the privilege of the account being modified.
RemediationAI
Update the TrueBooker plugin to the first release published after 1.2.3 that incorporates the fix from WordPress plugin changeset 3595807 (https://plugins.trac.wordpress.org/changeset/3595807/truebooker-appointment-booking); the exact patched version number is not stated in the available data, so verify the fixed release against the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/afe10c10-cace-4ce4-a813-6fda04c8d3dd) before deploying. If an immediate update is not possible, deactivate and remove the TrueBooker plugin so its vulnerable password-change endpoint is no longer reachable - the trade-off is loss of appointment-booking functionality on the site. As an interim compensating control, use a WAF or Wordfence firewall rule to block requests to the plugin's password-change action/AJAX handler, and require administrators to reset their passwords and audit for unexpected account changes, accepting that a WAF rule is a stopgap that can be bypassed and does not address the underlying missing authorization check.
Account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1
Account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1
The TrueBooker - Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in
Unauthenticated attackers can directly access view PHP files in the Truebooker WordPress plugin (versions up to 1.1.4) t
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today