CVE-2026-39798

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress (up to and including 1.2.6) is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover. The admin_user_create_cus AJAX handler lacks authentication or capability checks, allowing unauthenticated attackers to overwrite the email address of any user, including an administrator, and then use the standard lost-password flow to fully take over the account.

Unauthenticated privilege escalation vulnerability in TrueBooker versions up to and including 1.2.6. An attacker without logging in can elevate privileges, e.g., to administrator level.

The TrueBooker WordPress plugin before 1.2.7 lacks proper authorization checks in some AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.

The TrueBooker plugin for WordPress up to version 1.2.6 is vulnerable to account takeover. The add_front_user_update() AJAX handler is registered for unauthenticated users and accepts an arbitrary truebooker_wp_user_id value, which is passed directly to wp_update_user() without verifying authentication or ownership. This allows unauthenticated attackers to change any user's email address, including an administrator's, and then use the native password reset flow to take over the account.

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress, in all versions up to and including 1.2.3, is vulnerable to authorization bypass. The plugin does not properly verify that a user is authorized to perform an action, allowing unauthenticated attackers to change the password of arbitrary user accounts, including administrators.

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress, in all versions up to and including 1.2.3, is vulnerable to account takeover via improper password reset validation. The plugin does not properly validate a user's identity before resetting their password, allowing unauthenticated attackers to reset passwords of arbitrary user accounts, including administrators.

The TrueBooker WordPress plugin before version 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers. This allows unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.

The TrueBooker plugin versions up to 1.2.3 contain an unauthenticated privilege escalation vulnerability.

The TrueBooker plugin versions up to 1.2.3 are vulnerable to unauthenticated SQL injection.

Versions of TrueBooker <= 1.1.9 have an unauthenticated broken access control vulnerability that may allow attackers to access resources they should not have access to.