Unauthenticated Password Reset in TrueBooker WordPress Plugin

Executive Summary

The TrueBooker WordPress plugin before version 1.2.4 has a critical flaw in its password reset process. It does not verify if a user requesting a password reset actually owns the account. This allows unauthenticated attackers to reset passwords for any account, including administrators, by exploiting nonces from public pages and sending a crafted request. The attack requires no prior access and works even without an active password reset request.

Useful 0 Not Useful 0

Detection Guidance

Check if the TrueBooker plugin version is below 1.2.4 by inspecting the WordPress admin panel or running a command like 'wp plugin list' in the WordPress directory. Look for the presence of the plugin's shortcode on any public page as it indicates potential exposure.

Useful 0 Not Useful 0

Impact Analysis

If you use the TrueBooker plugin before version 1.2.4, attackers can take over any user account on your WordPress site, including administrator accounts. This could lead to full site compromise, data theft, or defacement. On multisite installations, compromising the Super Admin account grants control over the entire network.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating GDPR and HIPAA requirements for data protection and access control. A successful exploit may result in data breaches, triggering mandatory breach notifications and potential fines under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update the TrueBooker plugin to version 1.2.4 or later immediately. If updating is not possible, consider disabling the plugin temporarily until a patch is applied. Review all user accounts for unauthorized changes and reset passwords for critical accounts like administrators.

Useful 0 Not Useful 0