CVE-2026-18315

Name of the Vulnerable Software and Affected Versions TrueBooker – Appointment Booking and Scheduler System versions prior to 1.2.7

Description An authorization bypass exists due to the admin user create cus AJAX handler lacking authentication or capability checks. This allows unauthenticated attackers to pass a controlled truebooker wp user id parameter directly to the wp update user() function. By exploiting this, an attacker can overwrite the email address of any WordPress user, including administrators, and use the standard lost-password process to take full control of the account.

Recommendations Update the plugin to a version later than 1.2.6. As a temporary mitigation, restrict access to the admin user create cus AJAX handler.