Description

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity before resetting their password. This makes it possible for unauthenticated attackers to reset the password of arbitrary user accounts, including administrators, and gain access to those accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-07T05:16:57.743Z",
  "pubdate": "2026-08-07T05:16:57.743Z",
  "executiveSummary": "The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress in all versions up to, and including, 1.2.3 is susceptible to an improper password reset validation vulnerability.\nThis security flaw enables unauthenticated malicious actors to execute arbitrary password resets against targeted accounts, including highly privileged administrator accounts, culminating in full account takeover.\nThe root cause stems from the application logic failing to rigorously verify the identity of the user initiating the password reset procedure.\nConsequently, an attacker can manipulate the password reset mechanism without possessing prior authentication or authorization credentials.\nThe impact of successful exploitation is critical, as unauthorized administrative access allows complete compromise of the underlying WordPress installation, potential data exfiltration, malicious modification of appointment booking schedules, and persistent remote code execution via administrative plugin or theme manipulation.\nExploitation requires network access to the vulnerable WordPress endpoint running the affected plugin versions, with no prior authentication prerequisites required by the attacker.",
  "technicalDetails": "The vulnerability resides within the password reset handling logic of the TrueBooker – Appointment Booking and Scheduler System plugin for WordPress, affecting all versions up to, and including, 1.2.3.\nThe root cause of the vulnerability is the absence of proper identity validation and cryptographic verification during the password reset workflow.\nSpecifically, the component responsible for processing password reset requests fails to cryptographically bind the reset token or request to a verifiable user session, email confirmation, or secret token known exclusively to the legitimate account owner.\nBecause the input parameters handling the user identification are accepted without robust server-side validation or verification of previous state, an attacker can supply the username or user identifier of an arbitrary target account to the vulnerable endpoint.\nThe attack flow proceeds as follows: First, the unauthenticated attacker identifies the target user identifier or username, such as an administrator account. Second, the attacker interacts with the password reset functionality exposed by the TrueBooker plugin, submitting the targeted user's identifier alongside a new desired password or a manipulated reset payload.\nThird, due to the lack of adequate identity validation, the vulnerable component processes the request as legitimate without requiring confirmation via a secure out-of-band mechanism, such as a time-limited cryptographically secure token sent to the user's registered email address.\nFourth, the application updates the password hash in the database for the specified arbitrary user account.\nFinally, the attacker authenticates using the newly set password to hijack the victim's session, achieving total account takeover.\nThe vulnerability is exposed over the network via standard HTTP/HTTPS protocols handling WordPress AJAX or REST API endpoints associated with the TrueBooker plugin.\nAuthentication and privilege requirements are entirely absent, allowing unauthenticated remote attackers to execute the exploit successfully.\nPost-exploitation impact includes unauthorized administrative session establishment, unauthorized modification of scheduling data, injection of malicious scripts or webshells through the WordPress dashboard, and complete systemic compromise of the hosting environment."
}