A critical flaw in the TrueBooker appointment booking plugin lets unauthenticated attackers change any WordPress user's email address, including an administrator's, and hijack the account through the standard password reset flow.
What Is It
CVE-2026-16142 is an authorization bypass in the TrueBooker plugin for WordPress, affecting all versions up to and including 1.2.6. The plugin registers its add_front_user_update() AJAX handler for unauthenticated users. That handler accepts an arbitrary truebooker_wp_user_id value and passes it directly to wp_update_user() without verifying authentication or ownership of the target account.
The result is a classic CWE-639 (Authorization Bypass Through User-Controlled Key) condition: the attacker picks the user ID, and the plugin trusts it.
Why It Matters
The vulnerability carries a CVSS 3.1 base score of 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, no user interaction, with high impact to confidentiality, integrity, and availability.
The attack chain is short. An unauthenticated attacker submits a target user ID along with an email address they control. The plugin rewrites that account's email. The attacker then triggers WordPress's native password reset, receives the reset link at their own inbox, and takes over the account. Point it at user ID 1 and that is typically full administrator control of the site.
There is no public confirmation of exploitation in the wild at this time.
What's Vulnerable
- Vendor: themetechmount
- Product: TrueBooker – Appointment Booking and Scheduler System (WordPress plugin)
- Affected versions: all versions through 1.2.6 (semver range
0to<= 1.2.6)
Versions outside that range are marked unaffected in the CVE record.
Patch Status
The vendor has committed a fix to the WordPress plugin repository; changeset 3640018 for truebooker-appointment-booking. Site operators running 1.2.6 or earlier should update to the patched release. The unauthenticated, network-reachable nature of the flaw makes prompt patching worthwhile.
The record was published 2026-08-15 by Wordfence ([email protected]) and remains in Received status, meaning NVD analysis is not yet complete.
Sources
- NVD, CVE-2026-16142: https://nvd.nist.gov/vuln/detail/CVE-2026-16142
- WordPress Plugin Trac; changeset 3640018: https://plugins.trac.wordpress.org/changeset/3640018/truebooker-appointment-booking
- Wordfence Threat Intelligence: https://www.wordfence.com/threat-intel/vulnerabilities/id/f0d3f7cb-4974-4b0f-9658-1895e5966276?source=cve