CVE-2026-16142

Name of the Vulnerable Software and Affected Versions TrueBooker versions prior to 1.2.7

Description The plugin is susceptible to account takeover because the add front user update() AJAX handler is accessible to unauthenticated users. The handler accepts an arbitrary truebooker wp user id value and passes it to the wp update user() function without verifying the user's authentication or ownership of the account. This allows an unauthenticated attacker to change the email address of any WordPress user, including administrators, by providing the target user ID and a controlled email address. Subsequently, the attacker can utilize the standard WordPress password reset process to gain full control of the account.

Recommendations Update the plugin to a version later than 1.2.6. As a temporary mitigation, restrict access to the add front user update() AJAX handler.