TrueBooker CVE-2026-18776

The only prerequisite is that the target WordPress site has the TrueBooker plugin installed and active at a version below 1.2.7 and reachable over the network; the vulnerable AJAX actions are exposed to unauthenticated callers by default, so no special plugin configuration, authentication, or user interaction is required (AV:N/AC:L/PR:N/UI:N). Exploitation is limited chiefly by whether the vulnerable plugin is actually present and by whether the WordPress email and password-reset delivery path functions - the takeover step depends on the standard WordPress password-reset flow being enabled so the attacker can complete the reset after changing the victim's email.

The signals are mixed but lean toward genuine priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a trivially reachable, unauthenticated, no-interaction network attack yielding full account takeover of an administrator - an inherently high-impact outcome. Against that, EPSS is only 0.15% (4th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, so there is currently no evidence of active or automated exploitation in the wild. The tension is typical of freshly disclosed WordPress plugin flaws: the technical impact is severe and the exploitation barrier is low, so weaponisation could rise quickly once details or a proof-of-concept circulate, even though telemetry today shows little activity. Given how mechanically simple the takeover is, even a mid-sized municipal IT team in koszalin running this plugin should treat patching as urgent rather than waiting for EPSS to climb. Net: a real priority for any site actually running TrueBooker, but the current real-world exploitation likelihood is low and probably targeted rather than mass-scanned.

An unauthenticated attacker sends a crafted POST to the plugin's vulnerable admin-ajax.php action, setting a target administrator's user ID and substituting an attacker-controlled email address. They then trigger WordPress's 'lost password' flow for that admin, receive the reset link at their own inbox, set a new password, and log in with full administrative control. No proof-of-concept is public at time of analysis, but the low attack complexity means a working exploit would be straightforward to develop.