Description

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-19T06:17:37.973Z",
  "pubdate": "2026-08-19T06:17:37.973Z",
  "executiveSummary": "The TrueBooker WordPress plugin prior to version 1.2.7 suffers from an improper authorization vulnerability affecting specific AJAX action handlers. This security flaw enables unauthenticated remote attackers to arbitrarily modify the registered email address of any system user, including high-privileged accounts such as administrators.\nThe primary impact of this vulnerability is complete account compromise and unauthorized privilege escalation. By altering a target user's email address to one controlled by the attacker, malicious actors can leverage the native WordPress password reset mechanism to generate legitimate recovery tokens, finalize the password reset process, and gain full administrative access to the underlying WordPress installation.\nThe risk implication is severe, as successful exploitation results in total system compromise, arbitrary code execution via administrative capabilities, and potential data exfiltration or malware deployment. The attack requires no prior authentication, specific privileges, or user interaction, lowering the barrier to entry for potential adversaries interacting with the exposed AJAX endpoints over the network.",
  "technicalDetails": "The vulnerability resides within the AJAX action handling mechanisms implemented by the TrueBooker WordPress plugin in versions prior to 1.2.7. The root cause of the security defect is the complete absence of proper authorization checks and nonces validation within specific AJAX callback functions.\nIn WordPress plugin architecture, AJAX actions intended for unauthenticated users are typically registered using the wp_ajax_nopriv_<action> hook, whereas actions restricted to authenticated users utilize wp_ajax_<action>. Vulnerabilities of this nature typically occur when administrative or user-modifying operations are either improperly registered under the nopriv hook or fail to verify the current session's user capabilities and cryptographically secure anti-CSRF tokens (nonces) inside the handler function itself.\nThe exploitation method involves sending crafted HTTP POST requests directly to the standard WordPress AJAX endpoint (/wp-admin/admin-ajax.php) targeting the vulnerable TrueBooker AJAX actions. Because the underlying request handler lacks adequate access control enforcement, it processes the supplied parameters without verifying whether the requesting party possesses authorization to modify the targeted user record.\nThe step-by-step attack flow proceeds as follows: First, the attacker identifies or queries the target user identifier, such as the administrator account typically associated with user ID 1. Second, the attacker formulates an HTTP POST request targeting the vulnerable AJAX action, supplying parameters designed to update the account details, specifically substituting the victim's email address with an attacker-controlled email address. Third, upon processing the request, the TrueBooker plugin updates the user meta table in the WordPress database, binding the target administrative account to the new email address.\nOnce the database record is updated, the post-exploitation phase begins immediately. The attacker navigates to the standard WordPress password reset interface and initiates a recovery request for the compromised administrative username. WordPress generates a password reset link and transmits it to the updated email address now monitored by the attacker. Finally, the attacker follows the reset link, assigns a new password to the administrative account, and authenticates to the WordPress dashboard with full administrative privileges."
}