TrueBooker - Appointment Booking and Scheduler System WordPress plugin is a tool designed for businesses to facilitate online booking and scheduling. Typically used by service-oriented organizations, it simplifies the appointment management process for both administrators and customers. Integrated with WordPress, it allows seamless configuration and user management through an admin interface. Its functionalities are designed to be user-friendly, allowing for booking and scheduling tasks without excessive technical know-how. Utilized by small to medium businesses, its primary advantage is efficiently streamlining appointment processes. By utilizing this plugin, businesses enhance their operational effectiveness and customer service quality.
The vulnerability detected in the TrueBooker - Appointment Booking plugin involves an unauthorized bypass that allows for admin account creation. By exploiting this flaw, an attacker can gain unauthorized access and control over the plugin's user interface functionalities. This is largely due to the lack of proper authentication checks in the admin_user_create_cus AJAX handler. Consequently, attackers can overwrite any user account's email and proceed to utilize the lost-password flow to gain full control. This vulnerability can be exploited without any authentication prerequisites, significantly increasing risk exposure. Protecting such exposures is vital to maintaining the integrity of the booking system.
The details of the vulnerability are tied to the admin_user_create_cus AJAX handler found in the plugin. A significant technical shortcoming is the absence of security checks around user-controlled keys, allowing unauthorized access. Attackers can leverage this endpoint to overwrite authorized user data, particularly email addresses. With access to email-modification methods, attackers can initiate a password reset, bypassing usual authentication requirements. This introduces both an entry point and a critical risk of account compromise. Recognizing and patching this security lapse is essential to safeguard user accounts.
When exploited, this vulnerability may allow attackers to fully compromise user accounts, including administrative ones. The unauthorized account creation opens pathways for data theft, malicious configurations, and system misuse. Malicious users can elevate their privileges, accessing sensitive data meant only for administrative users. The potential misuse of user accounts allows the implantation of backdoors or distribution of malware through the system. Ultimately, the organization's operations and reputation may be severely affected, necessitating urgent remediation actions.
REFERENCES
- https://patchstack.com/database/wordpress/plugin/truebooker-appointment-booking/vulnerability/wordpress-truebooker-plugin-1-2-6-unauthenticated-authorization-bypass-through-user-controlled-key-to-account-takeover-to-truebooker-wp-user-id-parameter-vulnerability
- https://github.com/nastar-id/CVE-2026-18315-PoC
- https://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.2.6/main/function_ajax.php
- https://nvd.nist.gov/vuln/detail/CVE-2026-18315
- Update TrueBooker plugin to the latest version to patch the authorization bypass vulnerability.
- Implement stricter authentication checks for AJAX handlers within the plugin.
- Regularly audit plugins for potential security vulnerabilities and apply security patches promptly.
- Restrict access to admin-level functionalities to authenticated users only.
- Educate users and admins on recognizing signs of unauthorized access and reporting suspicious activity.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →