CVE-2026-18315

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the admin_user_create_cus AJAX handler lacking any authentication or capability check before passing the attacker-supplied truebooker_wp_user_id parameter directly to wp_update_user. This makes it possible for unauthenticated attackers to overwrite the email address of any WordPress user — including an administrator — and then complete the standard WordPress lost-password flow to fully take over the targeted account.

• CWE-639

• https://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.2.6/main/config/truebooker-style.php
• https://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.2.6/main/function_ajax.php
• https://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.2.6/templates/login-register.php
• https://plugins.trac.wordpress.org/changeset/3640018/truebooker-appointment-booking
• https://www.wordfence.com/threat-intel/vulnerabilities/id/73251a74-5be3-446b-8e0a-ff2d1484c467?source=cve

Published

Aug 19, 2026

Last Modified

Aug 21, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18308GIMP TIF File Parsing Integer Overflow Remote Code Execution…7.8
• CVE-2026-18309GIMP APNG File Parsing Integer Overflow Remote Code Executio…7.8
• CVE-2026-1831The YayMail - WooCommerce Email Customizer plugin for WordPr…2.7
• CVE-2026-18311Readwise Reader for Android contains a cross-site scripting …6.1
• CVE-2026-18312Readwise Reader for Android constructs URLs in its WebView u…6.1
• CVE-2026-18313rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPD…4.3
• CVE-2026-18316The Solace Extra plugin for WordPress is vulnerable to unaut…9.1
• CVE-2026-18317The Foxtool All-in-One: Contact chat button, Custom login, M…4.3
• CVE-2026-1832The ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge…4.3
• CVE-2026-18320Readwise Reader for Android uses a sanitize-html configurati…6.1
• CVE-2026-18321Buffer overflow in NTPsec's Zyfer refclock allows local atta…4.7
• CVE-2026-18322The Smart Popup by Supsystic plugin for WordPress is vulnera…8.8