CVE-2026-18315: falha crítica em themetechmount TrueBooker – Appointment…
TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter
Publicada em · Atualizada em
70Vexday Risk Score
Priorize a correção. Ela exploração observada pelo VulnCheck e tem prova de conceito pública.
ssvc Actcvss 9.8epss 0.6%
da publicação à arma1 dias
Publicada no NVD19 de ago.
1ª PoC+1d
VulnCheck+55d
probabilidade de exploração
0.6%top 53% das CVEs
exploração observada
simVulnCheck
1 exploit(s) público(s)
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the admin_user_create_cus AJAX handler lacking any authentication or capability check before passing the attacker-supplied truebooker_wp_user_id parameter directly to wp_update_user. This makes it possible for unauthenticated attackers to overwrite the email address of any WordPress user — including an administrator — and then complete the standard WordPress lost-password flow to fully take over the targeted account.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
PoCs públicas encontradas — 1
githubgithub.com/nastar-id/CVE-2026-18315-PoC★ 0⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — themetechmount TrueBooker – Appointment…
No mesmo produto, das mais perigosas para as menos.
CVE-2026-13161HIGHTrueBooker <= 1.2.2 - Unauthenticated SQL InjectionEPSS 0.8%CVE-2026-16142CRITICALTrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' ParameterEPSS 0.7%CVE-2026-14365CRITICALTrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id'EPSS 0.6%CVE-2026-14364CRITICALTrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'EPSS 0.5%CVE-2026-14349CRITICALTrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX ActionEPSS 0.4%CVE-2026-1797MEDIUMTruebooker - Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views FilesEPSS 0.2%
Referências
https://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.2.6/main/config/truebooker-style.phphttps://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.2.6/main/function_ajax.phphttps://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.2.6/templates/login-register.phphttps://plugins.trac.wordpress.org/changeset/3640018/truebooker-appointment-bookinghttps://www.wordfence.com/threat-intel/vulnerabilities/id/73251a74-5be3-446b-8e0a-ff2d1484c467?source=cve