EUVD-2026-62630
GHSA-7xx3-2cj6-229w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network request with no interaction (AV:N/AC:L/PR:N/UI:N) yields full administrator takeover, so confidentiality, integrity, and availability are all High.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The TrueBooker - Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the admin_user_create_cus AJAX handler lacking any authentication or capability check before passing the attacker-supplied truebooker_wp_user_id parameter directly to wp_update_user. This makes it possible for unauthenticated attackers to overwrite the email address of any WordPress user - including an administrator - and then complete the standard WordPress lost-password flow to fully take over the targeted account.
Articles & Coverage 1
AnalysisAI
Account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1.2.6) lets unauthenticated remote attackers hijack any account, including administrators. The admin_user_create_cus AJAX action performs no authentication or capability check and feeds the attacker-controlled truebooker_wp_user_id parameter straight into wp_update_user, allowing an attacker to overwrite a target user's email and then seize the account via the standard WordPress lost-password reset. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The only prerequisite is that the target WordPress site has the TrueBooker - Appointment Booking and Scheduler System plugin installed and active at version 1.2.6 or earlier, exposing the admin_user_create_cus AJAX action to unauthenticated callers via admin-ajax.php. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All signals point to a genuine high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the plugin to a version newer than 1.2.6 - a fix appears in WordPress plugin SVN changeset 3640018 (https://plugins.trac.wordpress.org/changeset/3640018/truebooker-appointment-booking), so upgrade to the first release above 1.2.6 as soon as it is confirmed on wordpress.org; an exact fixed version number is not stated in the available data, so verify the release tag before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all WordPress installations to identify those running TrueBooker versions 1.2.6 and earlier, and immediately disable the plugin on all affected systems pending remediation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all ve
Account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1
Unauthenticated attackers can directly access view PHP files in the Truebooker WordPress plugin (versions up to 1.1.4) t
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today