TrueBooker WordPress Plugin Unauthenticated Account Takeover via User-Controlled Key (CVE-2026-18315)

Vulnerability Overview Vulnerability Name: TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter CVE ID: CVE-2026-18315 CVSS Score: 9.8 (Critical) Release Date: August 16, 2026 Last Updated: August 19, 2026 Researcher: Decio Brandão Affected Range Software Type: Plugin Software Name: TrueBooker - Appointment Booking and Scheduler System Affected Versions: <= 1.2.6 Fixed Versions: 1.2.7 Remediation Remediation Measure: Upgrade to version 1.2.7 or later Vulnerability Description The TrueBooker plugin contains an unauthenticated authorization bypass vulnerability that allows attackers to take over accounts via user-controlled keys ( ). This vulnerability enables an attacker to directly call by passing a attacker-supplied parameter, thereby overwriting the email address of any WordPress user, including administrator accounts, and completing the standard WordPress password reset flow to fully take over the target account. References plugins.svn.wordpress.org plugins.svn.wordpress.org plugins.svn.wordpress.org plugins.trac.wordpress.org Additional Information Patch Status: Fixed Patch Version: 1.2.7 Recent Vulnerability List Additional Information Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: Customers receive 24/7 support with a 1-hour response time Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Other Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media X Facebook Instagram YouTube Products and Support Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Subscribe to Updates Stay Updated: Sign up for news and updates from our panel of experienced security professionals. Disclaimer Disclaimer: This record contains material that is subject to copyright. Contact Information Contact: If you have information to add, or spot any errors? Contact us at wfi-support@wordfence.com so we can make any appropriate adjustments. Summary This vulnerability represents a critical security issue affecting multiple versions of the TrueBooker plugin. It is recommended to upgrade to version 1.2.7 or later as soon as possible to remediate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

TrueBooker WordPress Plugin Unauthenticated Account Takeover via User-Controlled Key (CVE-2026-18315)

More from this source