Executive brief
TrueBooker is a WordPress plugin that manages appointment bookings and scheduling for businesses. An unauthenticated attacker can exploit a missing authorization check in the plugin's AJAX handler to change any user's email address, including administrators. By changing an admin's email, the attacker can then use WordPress's password reset feature to gain full access to the administrative account and the entire website.
Technical details
The vulnerability exists in the admin_user_create_cus AJAX handler, which accepts a user-controlled truebooker_wp_user_id parameter and passes it directly to wp_update_user without performing any authentication or capability checks. Although the code checks for 'edit_users' capability in the truebooker_admin_addcustomer function, the vulnerable handler lacks these protections entirely, allowing any unauthenticated attacker to submit a POST request to admin-ajax.php with a target user ID and a new email address. Once the email is changed, the attacker can request a WordPress password reset, receive the reset link at the attacker-controlled email, and complete the account takeover. This affects all versions up to and including 1.2.6.
Affected products
- TrueBooker TrueBooker – Appointment Booking and Scheduler System up to and including 1.2.6
Timeline
- 2026-08-19: disclosed