CVE-2026-16142 themetechmount CVE debrief

Who should care

Administrators of WordPress sites using the TrueBooker plugin should be aware of this critical vulnerability and take immediate action to update the plugin and monitor for suspicious activity related to user account changes. This vulnerability has a CVSS score of 9.8 and is considered critical. Affected operators should prioritize patching and review compensating controls for exposed systems while remediation is scheduled and verified. Security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Vulnerability management and security teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Platform operators should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. IT teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and check relevant monitoring, detection, and logs for exposed assets that need extra review. Asset inventory management should be reviewed to identify potentially affected systems. Change management processes should be updated to include rollback/change windows for affected systems. Source tracking should be implemented to monitor for potential exploitation attempts. Monitoring and detection capabilities should be reviewed to ensure they can detect potential exploitation attempts. Compensating controls should be reviewed and updated to prevent account takeover. Security teams should also review and update incident response plans to include procedures for responding to account takeover attempts.

Technical summary

The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() AJAX handler being registered for unauthenticated users and accepting an arbitrary truebooker_wp_user_id value, which is passed directly to wp_update_user() without verifying authentication or ownership. The vulnerability allows unauthenticated attackers to change any WordPress user account email address, including an administrator, by submitting the target user ID and an attacker-controlled email address.

Defensive priority

High priority due to critical CVSS score and potential for account takeover.

Recommended defensive actions

• Update the TrueBooker plugin to a version that is not vulnerable
• Monitor for suspicious activity related to user account changes
• Implement additional security measures to prevent account takeover
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence from the NVD and Wordfence indicates a critical vulnerability in the TrueBooker plugin for WordPress. The vulnerability allows unauthenticated attackers to change any WordPress user account email address, including an administrator, by submitting the target user ID and an attacker-controlled email address.

Official resources