TrueBooker WordPress Plugin Vulnerable to Account Takeover
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- truebooker (wordpress)
- Patched version
- Not yet available
The TrueBooker, Appointment Booking and Scheduler System plugin for WordPress is reportedly vulnerable to an authorization bypass leading to account takeover in all versions up to, and including, 1.2.6.
What happened
The vulnerability, tracked as CVE-2026-18315, allows unauthenticated attackers to overwrite the email address of any WordPress user, including administrators, by exploiting the admin_user_create_cus AJAX handler. This handler lacks proper authentication and capability checks, enabling attackers to complete the standard WordPress lost-password flow and fully take over targeted accounts.
This issue was first flagged on 2026-08-19T19:17:11.980000+00:00 and is currently under investigation. The National Vulnerability Database (NVD) has assigned a CVSS score of 9.8, indicating a critical severity level.
What to do about it
- Upgrade the TrueBooker plugin to a version beyond 1.2.6 if an update is available.
- If no update is available, remove the TrueBooker plugin from your WordPress installation.
- Monitor the primary sources for updates on this vulnerability.
- Ensure that all WordPress installations are kept up to date with the latest security patches.
How 0Day would have caught this
truebooker is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using the TrueBooker plugin for WordPress in versions up to, and including, 1.2.6.
What should I do right now?
Upgrade to a version beyond 1.2.6 or remove the plugin if no update is available. Monitor the primary sources for updates.
Is this vulnerability being exploited in the wild?
There is no confirmed report of this vulnerability being exploited in the wild at this time. However, it is crucial to take immediate action to mitigate the risk.