TrueBooker <=1.2.6 未认证IDOR导致账户接管(CVE-2026-16142)

漏洞概述 漏洞名称: TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter CVE ID: CVE-2026-16142 CVSS评分: 9.8 (Critical) 发布日期: August 14, 2026 最后更新日期: August 15, 2026 研究人员: Nabil Irawan - Heroes Cyber Security 影响范围 软件类型: Plugin 软件名称: truebooker-appointment-booking 受影响版本: <= 1.2.6 修复版本: 1.2.7 修复方案 修复建议: 更新到版本 1.2.7 或更高版本 漏洞描述 TrueBooker 插件在 WordPress 中存在账户接管漏洞，影响所有版本直至 1.2.6。该漏洞是由于 AJAX 处理器未验证身份验证或所有权，导致攻击者可以更改任何 WordPress 用户账户的电子邮件地址，包括管理员。攻击者可以通过提交目标用户 ID 和攻击者控制的电子邮件地址，然后使用 WordPress 密码重置功能接收重置链接，从而接管账户。 参考链接 plugins.trac.wordpress.org 其他信息 授权绕过通过用户控制的键: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 近期漏洞 TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'lab-userid' - CVE ID: CVE-2026-14364 - CVSS: 9.8 - 研究人员: thevietron - 日期: August 6, 2026 TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id' - CVE ID: CVE-2026-14365 - CVSS: 9.8 - 研究人员: Nien Pham (nhiemt) - 日期: August 6, 2026 TrueBooker <= 1.2.2 - Unauthenticated SQL Injection - CVE ID: CVE-2026-13161 - CVSS: 7.5 - 研究人员: Karan J - 日期: July 27, 2026 TrueBooker - Appointment Booking and Scheduler System <= 1.2.3 - Unauthenticated Privilege Escalation - CVE ID: CVE-2026-61951 - CVSS: 9.8 - 研究人员: yangzoi - 日期: July 17, 2026 TrueBooker - Appointment Booking and Scheduler System <= 1.2.3 - Unauthenticated SQL Injection - CVE ID: CVE-2026-61950 - CVSS: 7.5 - 研究人员: Nguyen Dinh Hai (HaiND) - 日期: July 16, 2026 TrueBooker - Appointment Booking and Scheduler System <= 1.1.9 - Missing Authorization - CVE ID: CVE-2026-48891 - CVSS: 5.3 - 研究人员: Vincent Sevkli - 日期: June 2, 2026 TrueBooker - Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files - CVE ID: CVE-2026-1797 - CVSS: 5.3 - 研究人员: Kazuma Matsumoto - 日期: March 30, 2026 TrueBooker <= 1.1.6 - Missing Authorization - CVE ID: CVE-2026-39663 - CVSS: 5.3 - 研究人员: Nabil Irawan - 日期: February 18, 2026 TrueBooker <= 1.1.0 - Missing Authorization - CVE ID: CVE-2025-67581 - CVSS: 5.3 - 研究人员: daroo - 日期: December 15, 2025 TrueBooker <= 1.0.7 - Cross-Site Request Forgery - CVE ID: CVE-2025-47543 - CVSS: 4.3 - 研究人员: heudayroi - 日期: May 7, 2025 其他信息 Wordfence Intelligence 提供免费的个人和商业 API 访问 Wordfence Intelligence WordPress 漏洞数据库完全免费访问和查询 联系方式 联系邮箱: wfi-support@wordfence.com 版权声明 Copyright 2012-2026 Defiant Inc. Copyright 1999-2026 The MITRE Corporation 其他链接 Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information 社交媒体 Facebook Twitter LinkedIn Email 其他按钮 LEARN MORE GET WORDFENCE DOCUMENTATION 业务时间 9am-6pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays Response customers receive 24-hour support, 365 days a year, with a 1-hour response time 页脚 © 2012-2026 Defiant Inc. All Rights Reserved CRESCENT 其他信息 Wordfence Intelligence Vulnerability Database TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter 其他链接 Wordfence Intelligence Vulnerability Database TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter 其他信息 Wordfence Intelligence Vulnerability Database TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter 其他链接 Wordfence Intelligence Vulnerability Database TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter 其他信息 Wordfence Intelligence Vulnerability Database TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter 其他链接 Wordfence Intelligence Vulnerability Database TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter 其他信息 Wordfence Intelligence Vulnerability Database TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter 其他链接 Wordfence Intelligence Vulnerability Database TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter 其他信息 Wordfence Intelligence Vulnerability Database TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter 其他链接 Wordfence Intelligence Vulnerability Database TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter 其他信息 Wordfence Intelligence Vulnerability Database TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter 其他链接 Wordfence Intelligence Vulnerability Database TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direc

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

TrueBooker <=1.2.6 未认证IDOR导致账户接管(CVE-2026-16142)

目标达成感谢每一位支持者 — 我们达成了 100% 目标！