Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-18315— TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter

Quick assessment

Affected
themetechmount TrueBooker – Appointment Booking and Scheduler System
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件 TrueBooker – Appointment Booking and Scheduler System 在 1.2.6 及以下版本中，存在“通过用户控制的键进行授权绕过”漏洞，可导致账户接管。该漏洞源于 AJAX 处理程序 在将攻击者提供的 参数直接传递给 之前，未进行任何身份验证或权限检查。因此，未经身份验证的攻击者可以覆盖任何 WordPress 用户（包括管理员）的电子邮件地址，然后通过标准的 WordPress 忘记密码流程，完全接管目标账户。

CVSS 9.8 · Critical EPSS 0.44% · P37

Affected Version Matrix 1

VendorProduct Version RangeStatus
themetechmount TrueBooker – Appointment Booking and Scheduler System ≤ 1.2.6 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-18315

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the admin_user_create_cus AJAX handler lacking any authentication or capability check before passing the attacker-supplied truebooker_wp_user_id parameter directly to wp_update_user. This makes it possible for unauthenticated attackers to overwrite the email address of any WordPress user — including an administrator — and then complete the standard WordPress lost-password flow to fully take over the targeted account.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
themetechmount TrueBooker – Appointment Booking and Scheduler System 0 ~ 1.2.6 -

II. Public POCs for CVE-2026-18315

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-18315

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-18315 (2)

News Coverage for CVE-2026-18315 (1)

Other References for CVE-2026-18315 (1)

IV. Related Vulnerabilities

Same product: TrueBooker – Appointment Booking and Scheduler System
Same vendor: themetechmount
Same weakness: CWE-639

V. Comments for CVE-2026-18315

No comments yet

Leave a comment