A missing authentication check in the TrueBooker appointment booking plugin lets unauthenticated attackers rewrite any WordPress user's email address, including an administrator's, and seize the account through the standard password-reset flow.
What Is It
CVE-2026-18315 is an Authorization Bypass Through User-Controlled Key (CWE-639) in the TrueBooker – Appointment Booking and Scheduler System plugin for WordPress, published 2026-08-19 by Wordfence.
The plugin's admin_user_create_cus AJAX handler performs no authentication or capability check before passing the attacker-supplied truebooker_wp_user_id parameter directly to wp_update_user. Because the user ID is fully attacker-controlled, an unauthenticated request can overwrite the email address of any account on the site. The attacker then runs the normal WordPress lost-password flow against the address they just set and receives the reset link, completing a full account takeover.
Why It Matters
This carries a CVSS 3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The attack is network-reachable, low-complexity, requires no privileges, and requires no user interaction, with high impact to confidentiality, integrity, and availability. Administrator takeover on a WordPress site generally amounts to full site compromise.
CISA KEV: this CVE is not listed in CISA KEV as of publication, so no federal remediation deadline applies. Absence from the catalog is not evidence that exploitation is not occurring; it reflects only what CISA has confirmed and published to date.
What's Vulnerable
- Vendor: themetechmount
- Product: TrueBooker – Appointment Booking and Scheduler System (WordPress plugin)
- Affected versions: all versions up to and including 1.2.6
The relevant code paths cited by the researcher are main/function_ajax.php, templates/login-register.php, and main/config/truebooker-style.php in the 1.2.6 tag.
Patch Status
The NVD record does not name a fixed version. It does reference WordPress plugin changeset 3640018 for truebooker-appointment-booking, which appears to be the code change associated with this issue, though the record does not state so explicitly. Operators running 1.2.6 or earlier should treat the installation as vulnerable and update to the latest available release, or disable the plugin until an update confirmed to postdate that changeset is installed.
Sources
- NVD, CVE-2026-18315: https://nvd.nist.gov/vuln/detail/CVE-2026-18315
- Wordfence Threat Intelligence: https://www.wordfence.com/threat-intel/vulnerabilities/id/73251a74-5be3-446b-8e0a-ff2d1484c467?source=cve
- WordPress Plugin Trac changeset 3640018: https://plugins.trac.wordpress.org/changeset/3640018/truebooker-appointment-booking
- Vulnerable source (
function_ajax.php, v1.2.6): https://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.2.6/main/function_ajax.php - Vulnerable source (
login-register.php, v1.2.6): https://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.2.6/templates/login-register.php