TrueBooker CVE-2026-18315

The only prerequisite is that the target WordPress site has the TrueBooker - Appointment Booking and Scheduler System plugin installed and active at version 1.2.6 or earlier, exposing the admin_user_create_cus AJAX action to unauthenticated callers via admin-ajax.php. No authentication, no valid nonce, no user interaction, and no non-default plugin configuration are required - the missing capability check is in the shipped code path. To fully complete account takeover the attacker must also be able to receive the WordPress password-reset email at the address they inject (i.e., outbound site email must be functional) and must target a valid user ID, though ID 1 is the conventional administrator. Exploitation is limited only by whether the vulnerable plugin is present and by the site's ability to send the reset email.

All signals point to a genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes fully remote, unauthenticated, low-complexity exploitation with no user interaction and full compromise impact, which is consistent with the described mechanism of a missing auth check on an AJAX endpoint. The described outcome - administrator account takeover - justifies the C:H/I:H/A:H impact because a hijacked admin yields complete site control. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified, and no SSVC decision record was supplied; however, the primitive is trivially automatable (single unauthenticated request plus the built-in reset flow), which would map to a high 'Automatable' value. The vulnerability is NOT in CISA KEV and no POC is referenced, so this is not confirmed active exploitation - but WordPress plugin account-takeover bugs are historically mass-exploited quickly once details circulate. Net: treat as an urgent patch despite the absence of KEV/EPSS confirmation. No signals in the provided data conflict with each other.

An unauthenticated attacker sends a single crafted POST request to /wp-admin/admin-ajax.php invoking action=admin_user_create_cus with truebooker_wp_user_id set to 1 (the site administrator) and an email field pointing to a mailbox they control. The handler passes the values to wp_update_user, overwriting the admin's email; the attacker then triggers the standard WordPress lost-password flow, receives the reset link at their own mailbox, sets a new password, and logs in as administrator. No POC is publicly referenced, but the attack requires only commodity HTTP tooling.