EUVD-2026-49698
GHSA-h3v6-mwr7-vpq3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend password reset request to front-end endpoint with target user identifier
-
DeliveryHandler skips ownership verification
-
ExploitPassword is replaced with attacker-chosen value
-
ExecutionAttacker logs in with new credentials
-
ImpactEscalate to administrator privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No preconditions: the vulnerable password reset handler is exposed on all default installations of TrueBooker <1.2.4 without authentication, special configuration, or user interaction. The attacker needs only the target account identifier (e.g., username) to trigger the reset. No additional privileges or access are required beyond network connectivity to the WordPress site. |
| Impact | CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) signals a trivial unauthenticated remote attack with full confidentiality, integrity, and availability impact. However, the EPSS score of 0.14% (3rd percentile) predicts low real-world exploitation activity, contrasting with the presence of public exploit code. No CISA KEV entry confirms active attacks. The divergence suggests the plugin’s limited deployment footprint may keep exploitation sparse, but any exposed instance faces critical risk. Organizations using TrueBooker must treat this as a high-priority fix. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted password reset request to the plugin’s front-end endpoint, providing the username or ID of a targeted administrator. The handler resets the password without verifying account ownership, allowing the attacker to log in with the newly set credentials and gain full administrative control of the WordPress site. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
Account takeover in TrueBooker WordPress plugin before 1.2.4 enables unauthenticated attackers to reset any user’s password via a front-end handler lacking ownership validation, compromising the entire site. Public proof-of-concept exploit code is available, though EPSS exploitation probability remains low (0.14%) and no CISA KEV listing confirms active exploitation.
RemediationAI
Upgrade to TrueBooker version 1.2.4 or later, as the vendor has released a patch addressing the missing ownership validation. Install the update from the WordPress plugin repository. If immediate patching is impossible, disable the TrueBooker plugin entirely to remove the vulnerable front-end handler-though this will eliminate all booking features. No other workaround is available. Reference: https://wpscan.com/vulnerability/c97d9841-2bd7-438b-a719-7943d671c754/.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The TrueBooker WordPress plugin provides a front-end account management interface that includes password reset functionality. Due to CWE-269 (Improper Privilege Management), the handler does not verify that the requestor owns the target account before setting a new password. This allows an attacker to bypass WordPress’s built-in authentication controls. The identified CPE (cpe:2.3:a:unknown:truebooker:*:*:*:*:*:*:*:*) indicates the plugin is widely identified as ‘TrueBooker’, though the vendor string is recorded as ‘unknown’.
Know when Truebooker gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote network attack with no privileges or user interaction, leading to full compromise.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.
Articles & Coverage 2
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Truebooker
View allThe TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL
Privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin through version 1.2.3 lets unau
Unauthenticated privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin versions 1.2.6
Unauthenticated SQL injection in the TrueBooker (truebooker-appointment-booking) WordPress plugin by themetechmount affe
TrueBooker, a WordPress booking/appointment plugin, renders a booking confirmation summary without verifying that the re
Missing authorization checks in the TrueBooker WordPress plugin before 1.3.0 allow unauthenticated remote attackers to c
Unauthenticated attackers can create TrueBooker bookings at attacker-chosen prices and attach them to arbitrary customer
TrueBooker, a WordPress plugin, lets unauthenticated remote attackers rewrite its entire stored configuration because on
Unauthenticated broken access control in the TrueBooker WordPress appointment-booking plugin (versions ≤ 1.1.9 by ThemeT
The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could a
Unauthenticated settings modification in the TrueBooker appointment-booking WordPress plugin (versions 1.2.9 and earlier
TrueBooker appointment booking plugin through version 1.1.5 fails to enforce proper authorization controls, allowing una
Exploit-DB