Account Takeover in TrueBooker WordPress Plugin via Unauthenticated AJAX

The TrueBooker plugin for WordPress (versions 1.2.6 and earlier) is susceptible to an unauthenticated account takeover vulnerability, designated as CVE-2026-16142. The flaw exists within the 'add_front_user_update()' AJAX handler, which fails to verify the authentication status or the ownership of the account being modified. Because the handler trusts user-supplied input for the 'truebooker_wp_user_id' parameter and passes it directly to the 'wp_update_user()' function, unauthenticated attackers can overwrite the email address associated with any user account, including administrative accounts. By redirecting a target account's email to an attacker-controlled address, the threat actor can leverage the native WordPress password reset functionality to seize control of the account. This vulnerability poses a severe risk to WordPress installations utilizing this plugin.

Attack Chain

1. Attacker identifies a WordPress installation running the vulnerable TrueBooker plugin version 1.2.6 or earlier.
2. Attacker crafts a malicious AJAX request targeting the 'add_front_user_update()' action.
3. Attacker specifies the 'truebooker_wp_user_id' parameter corresponding to the target administrator account ID.
4. Attacker provides an arbitrary, attacker-controlled email address in the request parameters.
5. The vulnerable plugin accepts the request without authentication checks and executes 'wp_update_user()' using the provided inputs.
6. The target administrator's email address is successfully updated in the WordPress database to the attacker's email address.
7. Attacker initiates a standard password reset request for the target account via the legitimate WordPress '/wp-login.php?action=lostpassword' endpoint.
8. Attacker intercepts the reset token delivered to their controlled email and completes the password reset, successfully achieving full account takeover.

Impact

Successful exploitation allows unauthenticated attackers to gain full administrative control over the affected WordPress site. This leads to complete data exfiltration, defacement, the potential for further server-side command execution via administrative privileges, and the compromise of all user data stored within the application.

Recommendation

Prioritize the update of the TrueBooker plugin to the latest patched version. If updates are unavailable, disable the plugin immediately. Monitor web server logs for suspicious POST requests to 'admin-ajax.php' containing the 'truebooker_wp_user_id' parameter.