WordPress Plugin Vulnerabilities

TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJAX Actions

Description

The plugin does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.

Proof of Concept

Affects Plugins

Plugin icon
truebooker-appointment-booking
Fixed in 1.2.7

References

CVE
CVE-2026-18776

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
Abdullah Kareem
Submitter
Abdullah Kareem
Submitter website
https://cyberkareem.com
Submitter twitter
cyberkareem
Verified
Yes
WPVDB ID
4b6abb2d-941b-429f-a480-33d1aafad450

Timeline

Publicly Published
2026-08-17 (about 3 days ago)
Added
2026-08-17 (about 2 days ago)
Last Updated
2026-08-19 (about 9 hours ago)

Other

Published
Title
Published
2026-07-08
Title
MailerPress < 2.0.3 - Contributor+ Privilege Escalation
Published
2024-12-17
Title
VibeBP < 1.9.9.5 - Unauthenticated Privilege Escalation
Published
2026-06-15
Title
AllCoach < 1.0.2 - Unauthenticated Account Takeover
Published
2024-09-30
Title
WordPress & WooCommerce Affiliate Program < 8.5.0 - Authentication Bypass to Account Takeover and Privilege Escalation
Published
2020-03-31
Title
WordPress SEO Plugin - Rank Math < 1.0.41 - Privilege Escalation via Unprotected REST API Endpoint