Executive brief
TrueBooker is a WordPress plugin used for managing appointment bookings. A security flaw in the plugin allows anyone on the internet to reset the password of any user account, including site administrators, without needing to know the current password or have any special access. This could lead to a complete takeover of the website, allowing attackers to steal data, modify content, or lock out legitimate owners.
Technical details
The TrueBooker plugin's front-end password reset handler, specifically the 'user_front_resetpass' AJAX action, fails to verify the 'tbab-activekey' (activation key) when a user account is in its default state (empty user_activation_key). An unauthenticated attacker can exploit this by scraping two public nonces from the site's front-end and sending a crafted AJAX request to 'admin-ajax.php'. By specifying a target 'tbab-userid' (such as ID 1 for the administrator) and providing a new password, the attacker can bypass authentication and gain full administrative control. The vulnerability is fixed in version 1.2.4.
Affected products
- TrueBooker TrueBooker Appointment Booking < 1.2.4
Timeline
- 2026-07-07: disclosed: Vulnerability first published by WPScan
- 2026-07-28: advisory: CVE published in NVD
- 2026-07-28: patched: Fixed in version 1.2.4