CVE-2026-18315 themetechmount CVE debrief

Who should care

WordPress site owners and administrators using the TrueBooker – Appointment Booking and Scheduler System plugin, cybersecurity professionals responsible for monitoring and securing WordPress installations, and individuals concerned with the security of user accounts on WordPress-based platforms.

Technical summary

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress, up to and including version 1.2.6, is vulnerable to Authorization Bypass Through User-Controlled Key. This vulnerability allows unauthenticated attackers to overwrite the email address of any WordPress user, including administrators, by exploiting the admin_user_create_cus AJAX handler. The handler fails to perform necessary authentication or capability checks before passing the attacker-supplied truebooker_wp_user_id parameter to wp_update_user. Subsequently, attackers can complete the standard WordPress lost-password flow to fully take over the targeted account.

Defensive priority

High

Recommended defensive actions

• Apply the latest patch for the TrueBooker plugin (version 1.2.7 or later) to fix the authorization bypass vulnerability.
• Implement additional monitoring to detect potential exploitation attempts targeting the TrueBooker plugin.
• Restrict access to the admin_user_create_cus AJAX handler to prevent unauthorized modifications.
• Enforce strong password policies and multi-factor authentication for all WordPress users, especially administrators.
• Regularly review and update plugins and themes to ensure you have the latest security patches.

Evidence notes

The vulnerability exists in the TrueBooker – Appointment Booking and Scheduler System plugin for WordPress versions up to and including 1.2.6. The admin_user_create_cus AJAX handler does not perform authentication or capability checks before updating the user based on the truebooker_wp_user_id parameter provided by the attacker. This allows unauthenticated attackers to change the email address of any WordPress user, including administrators, and subsequently take over the account through the standard WordPress lost-password process.

Official resources