CVE-2026-18315
published 2026-08-19CVE-2026-18315: The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to…
PriorityP184critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
3.03%
87.4th percentile
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the admin_user_create_cus AJAX handler lacking any authentication or capability check before passing the attacker-supplied truebooker_wp_user_id parameter directly to wp_update_user. This makes it possible for unauthenticated attackers to overwrite the email address of any WordPress user — including an administrator — and then complete the standard WordPress lost-password flow to fully take over the targeted account.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| themetechmount | truebooker_appointment_booking_and_scheduler_system | <= 1.2.6 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and
ghsa_unreviewed·2026-08-19
CVE-2026-18315 [CRITICAL] CWE-639 The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the admin_user_create_cus AJAX handler lacking any authentication or capability check before passing the attacker-supplied truebooker_wp_user_id parameter directly to wp_update_user. This makes it possible for unauthenticated attackers to overwrite the email address of any WordPress user — including an administrator — and then complete the standard WordPress lost-password flow to fully take over the targeted account.
VulnCheck
Authorization Bypass Through User-Controlled Key
vulncheck·2026·CVSS 9.8
CVE-2026-18315 [CRITICAL] Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the admin_user_create_cus AJAX handler lacking any authentication or capability check before passing the attacker-supplied truebooker_wp_user_id parameter directly to wp_update_user. This makes it possible for unauthenticated attackers to overwrite the email address of any WordPress user — including an administrator — and then complete the standard WordPress lost-password flow to fully take over the targeted account.
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use o
No detection rules found.
Nuclei
TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass
nuclei·CVSS 9.8
CVE-2026-18315 [CRITICAL] TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass
TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass
TrueBooker – Appointment Booking and Scheduler System WordPress plugin <= 1.2.6 contains an authorization bypass through user-controlled key caused by lack of authentication in admin_user_create_cus AJAX handler, letting unauthenticated attackers take over any user account by overwriting email and using lost-password flow, exploit requires no authentication.
Template:
id: CVE-2026-18315
info:
name: TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass
author: 0x_Akoko
severity: critical
description: |
TrueBooker – Appointment Booking and Scheduler System WordPress plugin <= 1.2.6 contains an authorization bypass through user-controlled key caused by lack of authentication in admin_user_create_cus AJAX handler, letting unau
No writeups or analysis indexed.
https://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.2.6/main/config/truebooker-style.phphttps://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.2.6/main/function_ajax.phphttps://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.2.6/templates/login-register.phphttps://plugins.trac.wordpress.org/changeset/3640018/truebooker-appointment-bookinghttps://www.wordfence.com/threat-intel/vulnerabilities/id/73251a74-5be3-446b-8e0a-ff2d1484c467?source=cve
2026-08-19
Published
Exploited in the wild