Description

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the admin_user_create_cus AJAX handler lacking any authentication or capability check before passing the attacker-supplied truebooker_wp_user_id parameter directly to wp_update_user. This makes it possible for unauthenticated attackers to overwrite the email address of any WordPress user — including an administrator — and then complete the standard WordPress lost-password flow to fully take over the targeted account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-19T19:17:11.980Z",
  "pubdate": "2026-08-19T19:17:11.980Z",
  "executiveSummary": "The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress, in all versions up to and including 1.2.6, suffers from an Authorization Bypass Through User-Controlled Key vulnerability. This flaw enables unauthenticated malicious actors to achieve full account takeover of any WordPress user, including high-privileged administrators.\nThe vulnerability stems from the admin_user_create_cus AJAX action, which fails to enforce proper authentication and capability checks. By supplying an arbitrary attacker-controlled truebooker_wp_user_id parameter alongside a modified email address, an external attacker can exploit the wp_update_user function executed by the backend handler.\nThe security impact is critical because it compromises the integrity and confidentiality of the entire WordPress installation. By successfully overwriting a targeted administrator's email address, an unauthorized individual can immediately initiate and complete the standard WordPress password reset mechanism. This grants them unfettered administrative access to the affected website, potentially leading to remote code execution, sensitive data exposure, and complete system compromise. No prior authentication, special privileges, or user interaction are required for successful exploitation, making this a severe network-exposed threat vector that demands immediate attention and remediation.",
  "technicalDetails": "The vulnerability resides within the AJAX request handling mechanism of the TrueBooker – Appointment Booking and Scheduler System plugin, specifically targeting the admin_user_create_cus AJAX handler function. The root cause of the security defect is the complete absence of authentication validation and capability checks prior to processing user input.\nDuring execution, the vulnerable component directly accepts the attacker-supplied truebooker_wp_user_id parameter from the HTTP request and passes it directly into the WordPress core function wp_update_user. Because the underlying code fails to verify whether the incoming request originates from an authenticated user with administrative or appropriate manager privileges, any unauthenticated remote attacker can invoke this AJAX endpoint over the network.\nThe exploitation flow proceeds as follows: First, the unauthenticated attacker crafts an HTTP POST request targeting the WordPress admin-ajax.php endpoint with the action parameter set to admin_user_create_cus. Second, the attacker injects the truebooker_wp_user_id parameter corresponding to the target user account, such as a known administrator ID like 1, alongside a new, attacker-controlled email address. Third, the unauthenticated AJAX handler processes this payload without validation, invoking wp_update_user to overwrite the target user's registered email address in the database with the attacker's supplied value.\nOnce the database record is updated, the attacker initiates the standard WordPress lost-password recovery workflow (wp-login.php?action=lostpassword) for the targeted account. WordPress generates a password reset token and dispatches the confirmation link to the newly substituted email address controlled by the attacker. Upon receiving the reset link, the attacker establishes a new password, finalizing the account takeover process and gaining administrative privileges over the affected WordPress instance. The attack requires network access to the target web application, zero authentication, and leverages standard application logic flaws combined with insecure direct object manipulation."
}