Description

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to change the password of arbitrary user accounts, including administrators, which can be leveraged to gain access to those accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-07T05:16:57.883Z",
  "pubdate": "2026-08-07T05:16:57.883Z",
  "executiveSummary": "The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress, spanning all versions up to and including 1.2.3, suffers from a critical authorization bypass vulnerability. This security defect arises from the plugin's failure to adequately verify whether a requesting user possesses the necessary privileges to execute sensitive functions. Consequently, unauthenticated remote attackers can leverage this flaw to arbitrarily modify passwords for any registered user account within the WordPress installation, including high-privileged administrator accounts. The realization of this vulnerability introduces severe operational and security risks, effectively granting malicious actors complete administrative takeover capabilities over vulnerable WordPress instances without requiring prior authentication or interaction. The attack surface is exposed via network protocols, and exploitation requires no specialized privileges, allowing arbitrary actors to initiate password-reset operations directly against targeted accounts.",
  "technicalDetails": "The root cause of the vulnerability stems from missing or inadequate authorization checks within the request handling logic of the TrueBooker – Appointment Booking and Scheduler System plugin. Specifically, the affected component fails to validate the identity and authorization context of incoming requests destined for password modification endpoints or routines. Because the application processes these requests without enforcing session validity or permission validation, an unauthenticated attacker can directly interact with the underlying function responsible for updating user credentials. The attack flow begins with the attacker identifying the target user account, such as an administrator, typically via publicly available enumeration techniques or known usernames. The attacker then crafts a malicious HTTP request directed at the vulnerable endpoint associated with the TrueBooker plugin, supplying the target user identifier along with the new desired password payload. Due to the complete absence of access controls, the vulnerable function processes the input without verifying if the sender is the legitimate owner of the account or possesses administrative privileges. Upon successful execution of the payload, the password for the arbitrary user account is updated in the database. The network exposure is entirely remote, operating over standard HTTP/HTTPS protocols utilized by the WordPress platform. Post-exploitation impact is catastrophic, as the attacker can immediately authenticate using the newly modified credentials to access the hijacked administrative account. This grants the attacker full administrative control over the WordPress site, enabling malicious actions such as arbitrary file upload, execution of malicious PHP code via theme or plugin editors, installation of backdoors, database exfiltration, and complete compromise of the underlying hosting environment. The affected versions include all iterations up to and including 1.2.3, with no authentication or privilege requirements needed by the attacking party."
}