Unauthenticated Account Takeover in TrueBooker WordPress Plugin

The TrueBooker - Appointment Booking and Scheduler System plugin for WordPress contains a critical authorization bypass vulnerability (CVE-2026-18315) affecting all versions up to and including 1.2.6. The vulnerability resides within the 'admin_user_create_cus' AJAX handler, which fails to perform necessary authentication or capability checks.

Attackers can supply a 'truebooker_wp_user_id' parameter to the affected endpoint, which is then processed by 'wp_update_user' without verifying if the requestor has administrative privileges. By leveraging this, an unauthenticated actor can overwrite the email address associated with any user account in the WordPress database, including administrative accounts. Once the email address is updated to one controlled by the attacker, they can initiate the standard WordPress password reset process, intercept the recovery link, and gain full control over the compromised account. Defenders should identify any WordPress installations running this plugin and update to a patched version or disable the functionality immediately.

Impact

The vulnerability results in a total account takeover for any user, including site administrators. Successful exploitation leads to full unauthorized access to the WordPress environment, enabling the attacker to modify site content, inject malicious scripts, redirect traffic, or exfiltrate sensitive data. Given that this plugin is used for scheduling, the compromise could also lead to the exposure of customer personal information and booking logs. There are no observed victim counts at this time, but the exploit is trivial to execute remotely.

Recommendation

• Update the TrueBooker plugin to the latest version immediately to remediate the vulnerable AJAX handler.
• Audit WordPress user accounts for suspicious email address changes or recently created administrator accounts.
• Deploy the Sigma rule below to detect attempts to reach the vulnerable AJAX handler from external sources.
• Monitor web server logs for HTTP POST requests to 'admin-ajax.php' containing the 'admin_user_create_cus' action.