What is the CVSS score of CVE-2026-16142?

CVE-2026-16142 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of TrueBooker are affected by CVE-2026-16142?

TrueBooker WordPress appointment-booking plugin (versions ≤1.2.6) contains a critical account takeover vulnerability allowing unauthenticated attackers to seize administrator accounts and gain full…

How to fix or mitigate CVE-2026-16142?

Within 24 hours, audit all WordPress instances for TrueBooker versions ≤1.2.6, immediately deactivate and uninstall the plugin from all environments, and review admin account change logs for unauthorized email modifications in the past 30 days. Within 7 days, force mandatory password resets for all WordPress administrators, revoke all API tokens and SSH keys that could have been accessed through compromised admin accounts, and conduct a complete audit of user accounts and permissions for unauthorized changes. Within 30 days, replace TrueBooker with an alternative appointment-booking solution or monitor the vendor's security advisories daily for a patch release, complete a full security audit of all WordPress instances, and enforce multi-factor authentication on all administrative accounts to prevent future account takeover incidents.

TrueBooker CVE-2026-16142

EUVD-2026-59598 CRITICAL

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-15 security@wordfence.com

GHSA-76x4-wpvp-whc4

WordPress Authentication Bypass

9.8

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated nopriv AJAX handler reachable over the network with no interaction (AV:N/AC:L/PR:N/UI:N); resulting admin takeover yields full confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 15, 2026 - 09:31 vuln.today

CVE Published

Aug 15, 2026 - 09:16 nvd

CRITICAL 9.8

DescriptionCVE.org

The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() AJAX handler being registered for unauthenticated users and accepting an arbitrary truebooker_wp_user_id value, which is passed directly to wp_update_user() without verifying authentication or ownership. This makes it possible for unauthenticated attackers to change any WordPress user account email address, including an administrator, by submitting the target user ID and an attacker-controlled email address. An attacker can then use the native WordPress password reset flow to receive the reset link at the attacker-controlled email address and take over the account.

Articles & Coverage 1

News Critical Account Takeover in WordPress TrueBooker Plugin - CVE-2026-16142 Aug 16, 2026

AnalysisAI

Account takeover in the TrueBooker appointment-booking plugin for WordPress (all versions through 1.2.6) lets remote attackers hijack any account, including administrators. The add_front_user_update() AJAX action is exposed to unauthenticated visitors and trusts a caller-supplied truebooker_wp_user_id, so an attacker can rewrite an admin's email address and then use WordPress's built-in password-reset flow to seize the account. No public exploit has been identified at time of analysis, but the flaw is trivially exploitable and carries a CVSS of 9.8.

Technical ContextAI

The vulnerability lives in a WordPress AJAX endpoint. TrueBooker registers add_front_user_update() via the wp_ajax_nopriv_ hook, which makes the handler reachable by unauthenticated users, and then passes the attacker-controlled truebooker_wp_user_id straight into the core wp_update_user() function without a capability check, nonce validation, or an ownership comparison against the current session. This is a textbook CWE-639 (Authorization Bypass Through User-Controlled Key / insecure direct object reference): the account acted upon is chosen entirely by a client-supplied identifier rather than by the authenticated session, letting one user operate on another user's object. Because wp_update_user() accepts a new user_email, the attacker changes the victim's registered address and pivots through WordPress's native lost-password mechanism.

RemediationAI

Upgrade the TrueBooker plugin to the first release that contains the fix from trac changeset 3640018 (a released patched version was not stated in the source data, so update to the latest available version and verify the code no longer registers add_front_user_update() for nopriv users). Until the update is applied, the most effective compensating control is to deactivate and remove the TrueBooker plugin, which fully closes the exposed AJAX action at the cost of disabling appointment booking. If the plugin must stay active, block or restrict access to /wp-admin/admin-ajax.php requests carrying the action=add_front_user_update (or the truebooker_wp_user_id parameter) at a WAF or reverse proxy - trading a small risk of breaking legitimate front-end profile updates for immediate protection - and audit administrator email addresses for unexpected changes. Reference the vendor advisory at the Wordfence link above and the code change at https://plugins.trac.wordpress.org/changeset/3640018/truebooker-appointment-booking.