CVE-2026-18315
Received Received - Intake

Authorization Bypass in TrueBooker WordPress Plugin

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Wordfence

Description
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the admin_user_create_cus AJAX handler lacking any authentication or capability check before passing the attacker-supplied truebooker_wp_user_id parameter directly to wp_update_user. This makes it possible for unauthenticated attackers to overwrite the email address of any WordPress user — including an administrator — and then complete the standard WordPress lost-password flow to fully take over the targeted account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-18315
EUVD
EUVD-2026-62630

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
truebooker truebooker to 1.2.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Authorization Bypass Through User-Controlled Key in the TrueBooker WordPress plugin. It allows unauthenticated attackers to bypass authentication by directly manipulating user account details via the admin_user_create_cus AJAX handler. The plugin fails to check permissions before updating user emails using the truebooker_wp_user_id parameter, enabling account takeover.

Detection Guidance

Check WordPress sites using the TrueBooker plugin version 1.2.6 or lower. Look for unauthorized user account modifications or new admin accounts. Review server logs for suspicious AJAX requests to admin_user_create_cus.

Impact Analysis

If you use the TrueBooker plugin up to version 1.2.6, attackers can take over any WordPress account, including administrator accounts. They can change email addresses and reset passwords through WordPress's lost-password feature, gaining full control of your site. This could lead to data theft, malware installation, or site defacement.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face fines, legal action, and reputational damage if user data is compromised due to this flaw.

Mitigation Strategies

Update the TrueBooker plugin to the latest version. Remove or disable the plugin if no update is available. Implement strict WordPress user role checks and disable unauthenticated AJAX handlers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18315. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart