TrueBooker EUVD-2026-54364

The condition is simply that the vulnerable TrueBooker plugin (version ≤ 1.2.3) is installed and active on a reachable WordPress site; the vulnerable password-change action must be exposed as it is by default. No authentication, no user interaction, and no non-default configuration are required (AV:N/AC:L/PR:N/UI:N) - the only practical prerequisite is that the attacker targets a valid user ID (e.g. the administrator's), which is typically enumerable in WordPress. The main limiting factor is that the site must have this specific plugin installed and running an unpatched version; sites that have removed or updated the plugin are not exposed.

This is a genuine high-priority issue rather than an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) is internally consistent with the description: fully remote, no authentication, no user interaction, low complexity, and total compromise via administrator takeover. Authorization-bypass password resets in WordPress plugins are historically attractive for automated, opportunistic exploitation because the attack is a single unauthenticated HTTP request against a predictable endpoint. No EPSS score, KEV entry, or SSVC decision data was provided in the input, and no public proof-of-concept was referenced, so real-world exploitation volume cannot be confirmed from this data; however, the trivial attack requirements and the fact that a reputable source (Wordfence) catalogued it argue for prompt patching. No conflicting signals were present in the supplied data - the missing pieces are exploitation-probability metrics (EPSS) and confirmed in-the-wild activity, not contradictions.

An attacker enumerates or guesses the administrator user ID (WordPress user IDs are commonly discoverable, e.g. user 1) and sends a single crafted unauthenticated HTTP request to the plugin's password-change action supplying that ID and a new password. Because the handler never verifies the requester's authorization, the admin password is overwritten, and the attacker logs in with full administrative control. Given AV:N/AC:L/PR:N/UI:N the request needs no authentication, no victim interaction, and no special timing.