EUVD-2026-49698
GHSA-h3v6-mwr7-vpq3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote network attack with no privileges or user interaction, leading to full compromise.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.
Articles & Coverage 2
AnalysisAI
Account takeover in TrueBooker WordPress plugin before 1.2.4 enables unauthenticated attackers to reset any user’s password via a front-end handler lacking ownership validation, compromising the entire site. Public proof-of-concept exploit code is available, though EPSS exploitation probability remains low (0.14%) and no CISA KEV listing confirms active exploitation.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No preconditions: the vulnerable password reset handler is exposed on all default installations of TrueBooker <1.2.4 without authentication, special configuration, or user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) signals a trivial unauthenticated remote attack with full confidentiality, integrity, and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a crafted password reset request to the plugin’s front-end endpoint, providing the username or ID of a targeted administrator. The handler resets the password without verifying account ownership, allowing the attacker to log in with the newly set credentials and gain full administrative control of the WordPress site. |
| Remediation | Upgrade to TrueBooker version 1.2.4 or later, as the vendor has released a patch addressing the missing ownership validation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Truebooker
View allThe TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL
Privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin through version 1.2.3 lets unau
Unauthenticated SQL injection in the TrueBooker (truebooker-appointment-booking) WordPress plugin by themetechmount affe
Unauthenticated broken access control in the TrueBooker WordPress appointment-booking plugin (versions ≤ 1.1.9 by ThemeT
The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could a
TrueBooker appointment booking plugin through version 1.1.5 fails to enforce proper authorization controls, allowing una
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today