TrueBooker EUVD-2026-80094

No special conditions - remote unauthenticated exploitation against default configurations of the TrueBooker - Appointment Booking and Scheduler System WordPress plugin (any version ≤1.2.3). The only requirement is that the plugin is installed and active on a reachable WordPress site; the vulnerable AJAX endpoint (function_ajax.php) is accessible without authentication and needs no user interaction or non-default settings. The practical limiting factor is deployment footprint: this is a niche booking plugin, so exploitation is bounded by how many sites actually run it rather than by any technical prerequisite. Full impact (password reset takeover) also depends on standard WordPress email-based password recovery being enabled, which is the default.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) is internally consistent with the description: a fully remote, unauthenticated, low-complexity authorization bypass that leads directly to administrator account takeover. There is no conflict between the vector and the narrative - both point to trivial network exploitation. The mitigating signals are the exploitation-likelihood indicators: EPSS is only 0.42% (36th percentile), there is no CISA KEV listing, and no public exploit code has been identified, so this is 'no public exploit identified at time of analysis' rather than confirmed active exploitation. The gap between the near-maximum CVSS and the modest EPSS reflects that WordPress plugin authz bypasses are highly impactful when hit but this specific plugin has a limited install base, so mass automated exploitation is less likely than for ubiquitous plugins. Net: patch urgently for any site running TrueBooker (the takeover path is trivial and durable), but the low EPSS/no-KEV/no-POC signals mean it is not yet under widespread active attack.

An unauthenticated attacker sends a crafted AJAX request to the vulnerable TrueBooker endpoint (function_ajax.php) targeting an administrator's user ID and supplying an attacker-controlled email address. Because the plugin never verifies the caller is authorized to change that account, the admin's email is silently updated; the attacker then triggers WordPress's 'lost password' flow, receives the reset link at their own inbox, sets a new password, and logs in as administrator. No public exploit code is currently identified, but the attack requires only standard HTTP requests against a default installation.