Truebooker Appointment Booking And Scheduler System
Monthly
Unauthenticated attackers can take over arbitrary WordPress accounts - including administrator accounts - on any site running the TrueBooker - Appointment Booking and Scheduler System plugin through version 1.2.3, by invoking a plugin AJAX action that changes a target user's email address without any authorization check (CWE-862); the attacker then triggers WordPress's standard email-based password reset to that address and gains full control of the account. The issue is remotely exploitable with PR:N (no authentication, no user interaction, no non-default configuration required) and carries a CVSS 3.1 base score of 9.8, though EPSS is a low 0.42% (36th percentile) and no public exploit code or CISA KEV entry has been identified at time of analysis. Independent assessment rates this as a genuine high-priority issue rather than a high-CVSS-but-low-real-risk case: the limiting factor is deployment footprint (a niche booking plugin), not any technical prerequisite.
Account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1.2.6) lets unauthenticated remote attackers hijack any account, including administrators. The admin_user_create_cus AJAX action performs no authentication or capability check and feeds the attacker-controlled truebooker_wp_user_id parameter straight into wp_update_user, allowing an attacker to overwrite a target user's email and then seize the account via the standard WordPress lost-password reset. Reported by Wordfence and rated CVSS 9.8; no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1.2.3) lets unauthenticated attackers reset the password of any account, including administrators, because the plugin's password-reset flow never verifies the requester's identity. Successful exploitation yields full control of the targeted account and, via an admin takeover, the entire WordPress site. No public exploit identified at time of analysis, but the CVSS 9.8 rating and trivial network exploitability make this a high-priority patch.
Unauthenticated account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1.2.3) allows remote attackers to reset the password of any account, including administrators, because a password-change action fails to verify the requester's authorization. Successful exploitation yields full admin login and therefore complete control of the WordPress site. No public exploit identified at time of analysis; the flaw was reported by Wordfence and an upstream fix is present in the plugin repository.
Unauthenticated attackers can directly access view PHP files in the Truebooker WordPress plugin (versions up to 1.1.4) to disclose sensitive information, such as user data or system configuration details exposed in those templates. The vulnerability requires only network access and no authentication, making it trivially exploitable via simple HTTP requests to exposed PHP files. No public exploit code or active exploitation has been confirmed at this time.
Unauthenticated attackers can take over arbitrary WordPress accounts - including administrator accounts - on any site running the TrueBooker - Appointment Booking and Scheduler System plugin through version 1.2.3, by invoking a plugin AJAX action that changes a target user's email address without any authorization check (CWE-862); the attacker then triggers WordPress's standard email-based password reset to that address and gains full control of the account. The issue is remotely exploitable with PR:N (no authentication, no user interaction, no non-default configuration required) and carries a CVSS 3.1 base score of 9.8, though EPSS is a low 0.42% (36th percentile) and no public exploit code or CISA KEV entry has been identified at time of analysis. Independent assessment rates this as a genuine high-priority issue rather than a high-CVSS-but-low-real-risk case: the limiting factor is deployment footprint (a niche booking plugin), not any technical prerequisite.
Account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1.2.6) lets unauthenticated remote attackers hijack any account, including administrators. The admin_user_create_cus AJAX action performs no authentication or capability check and feeds the attacker-controlled truebooker_wp_user_id parameter straight into wp_update_user, allowing an attacker to overwrite a target user's email and then seize the account via the standard WordPress lost-password reset. Reported by Wordfence and rated CVSS 9.8; no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1.2.3) lets unauthenticated attackers reset the password of any account, including administrators, because the plugin's password-reset flow never verifies the requester's identity. Successful exploitation yields full control of the targeted account and, via an admin takeover, the entire WordPress site. No public exploit identified at time of analysis, but the CVSS 9.8 rating and trivial network exploitability make this a high-priority patch.
Unauthenticated account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1.2.3) allows remote attackers to reset the password of any account, including administrators, because a password-change action fails to verify the requester's authorization. Successful exploitation yields full admin login and therefore complete control of the WordPress site. No public exploit identified at time of analysis; the flaw was reported by Wordfence and an upstream fix is present in the plugin repository.
Unauthenticated attackers can directly access view PHP files in the Truebooker WordPress plugin (versions up to 1.1.4) to disclose sensitive information, such as user data or system configuration details exposed in those templates. The vulnerability requires only network access and no authentication, making it trivially exploitable via simple HTTP requests to exposed PHP files. No public exploit code or active exploitation has been confirmed at this time.