CVE-2026-16142
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: Wordfence

Description
The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() AJAX handler being registered for unauthenticated users and accepting an arbitrary truebooker_wp_user_id value, which is passed directly to wp_update_user() without verifying authentication or ownership. This makes it possible for unauthenticated attackers to change any WordPress user account email address, including an administrator, by submitting the target user ID and an attacker-controlled email address. An attacker can then use the native WordPress password reset flow to receive the reset link at the attacker-controlled email address and take over the account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-16142
EUVD
EUVD-2026-59598

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
truebooker truebooker_plugin to 1.2.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The TrueBooker WordPress plugin up to version 1.2.6 has an Account Takeover vulnerability. The add_front_user_update() function allows unauthenticated users to change any WordPress user's email address by submitting a target user ID and a new email. This happens because the plugin does not verify if the requester owns the account or is authenticated before updating user details.

Detection Guidance

Check for unauthorized changes to user email addresses in WordPress admin logs. Review network traffic for POST requests to /wp-admin/admin-ajax.php with the action add_front_user_update. Look for requests containing truebooker_wp_user_id and email parameters without authentication.

Impact Analysis

An attacker could take over any WordPress user account, including administrator accounts, by changing the email to one they control. They could then reset the password and gain full access to the compromised account. This could lead to unauthorized changes, data theft, or complete site takeover.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using this plugin may face compliance breaches, legal penalties, and reputational damage due to potential data exposure.

Mitigation Strategies

Update the TrueBooker plugin to the latest version if available. Disable the plugin if no update is available. Implement WordPress hardening measures like limiting admin-ajax.php access to authenticated users only. Monitor user accounts for unexpected email changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16142. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart