Description

The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() AJAX handler being registered for unauthenticated users and accepting an arbitrary truebooker_wp_user_id value, which is passed directly to wp_update_user() without verifying authentication or ownership. This makes it possible for unauthenticated attackers to change any WordPress user account email address, including an administrator, by submitting the target user ID and an attacker-controlled email address. An attacker can then use the native WordPress password reset flow to receive the reset link at the attacker-controlled email address and take over the account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-15T09:16:29.560Z",
  "pubdate": "2026-08-15T09:16:29.560Z",
  "executiveSummary": "The TrueBooker plugin for WordPress, in all versions up to and including 1.2.6, suffers from a critical Account Takeover vulnerability stemming from broken access controls within its AJAX request handling mechanism. This security flaw enables unauthenticated malicious actors to arbitrarily modify the email addresses associated with any registered WordPress user account, including high-privilege accounts such as administrators.\nThe core risk implication is complete system compromise, as an attacker who successfully alters a target user's email address can seamlessly leverage the native WordPress password reset functionality to intercept authentication recovery tokens. This grants the attacker unauthorized access and full administrative control over the underlying WordPress installation without requiring prior credentials or elevated privileges.\nThe vulnerability is exposed directly to the network via unauthenticated AJAX endpoints, requiring no user interaction other than submitting specially crafted HTTP requests containing target user identifiers and attacker-controlled parameters. Given the severity of the impact and the trivial execution requirements, immediate remediation or disabling of the vulnerable plugin is strongly advised to prevent malicious exploitation.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure implementation of the add_front_user_update() AJAX handler within the TrueBooker plugin. Specifically, this administrative or user-centric function is incorrectly registered and exposed to unauthenticated users, permitting remote invocation over the network without validating the session state, authentication tokens, or authorization boundaries.\nDuring execution, the vulnerable add_front_user_update() handler accepts an arbitrary truebooker_wp_user_id value supplied directly via user input parameters. This input is processed unsafely and passed straight to the core WordPress function wp_update_user() without performing any ownership verification or privilege checks to ensure that the user issuing the request is legally authorized to modify the targeted account.\nThe step-by-step attack flow proceeds as follows: First, an unauthenticated attacker identifies a target WordPress user ID, such as a known administrator account. Second, the attacker crafts an HTTP request targeting the TrueBooker AJAX endpoint, supplying the target truebooker_wp_user_id alongside an attacker-controlled email address designed to overwrite the existing account record. Third, the plugin processes the request and executes wp_update_user(), successfully changing the targeted account email address in the WordPress database to the attacker's supplied value.\nOnce the email address is successfully updated, the attacker transitions to the post-exploitation phase by initiating the native WordPress password reset flow for the targeted username. Because the account email has been maliciously modified, the password reset link is routed directly to the attacker. Finally, the attacker follows the link, sets a new password, and authenticates to the application with full administrative privileges."
}