CVE-2026-18315: critical vulnerability in themetechmount TrueBooker – Appointment…
TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter
Published · Updated
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.8epss 0.6%
from disclosure to weapon1 days
Published on NVDAug 19
1st PoC+1d
exploitation probability
0.6%top 53% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the admin_user_create_cus AJAX handler lacking any authentication or capability check before passing the attacker-supplied truebooker_wp_user_id parameter directly to wp_update_user. This makes it possible for unauthenticated attackers to overwrite the email address of any WordPress user — including an administrator — and then complete the standard WordPress lost-password flow to fully take over the targeted account.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
public PoCs found — 1
githubgithub.com/nastar-id/CVE-2026-18315-PoC★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — themetechmount TrueBooker – Appointment…
In the same product, most dangerous first.
CVE-2026-13161HIGHTrueBooker <= 1.2.2 - Unauthenticated SQL InjectionEPSS 0.8%CVE-2026-16142CRITICALTrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' ParameterEPSS 0.7%CVE-2026-14365CRITICALTrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id'EPSS 0.6%CVE-2026-14364CRITICALTrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'EPSS 0.5%CVE-2026-14349CRITICALTrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX ActionEPSS 0.4%CVE-2026-1797MEDIUMTruebooker - Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views FilesEPSS 0.2%
References
https://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.2.6/main/config/truebooker-style.phphttps://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.2.6/main/function_ajax.phphttps://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.2.6/templates/login-register.phphttps://plugins.trac.wordpress.org/changeset/3640018/truebooker-appointment-bookinghttps://www.wordfence.com/threat-intel/vulnerabilities/id/73251a74-5be3-446b-8e0a-ff2d1484c467?source=cve