CVE-2026-16142 in TrueBooker Plugin
Summary
by MITRE • 08/15/2026
The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() AJAX handler being registered for unauthenticated users and accepting an arbitrary truebooker_wp_user_id value, which is passed directly to wp_update_user() without verifying authentication or ownership. This makes it possible for unauthenticated attackers to change any WordPress user account email address, including an administrator, by submitting the target user ID and an attacker-controlled email address. An attacker can then use the native WordPress password reset flow to receive the reset link at the attacker-controlled email address and take over the account.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The TrueBooker plugin for WordPress presents a critical account takeover vulnerability affecting all versions up to and including 1.2.6, which stems from improper access control mechanisms within its AJAX handler implementation. This vulnerability resides in the add_front_user_update() function that registers an AJAX endpoint accessible to unauthenticated users, creating an unauthorized attack surface that bypasses standard WordPress authentication requirements. The flaw operates by accepting arbitrary truebooker_wp_user_id parameters through the frontend interface without implementing proper validation or ownership verification checks.
The technical exploitation of this vulnerability relies on the direct passage of user ID values to WordPress's native wp_update_user() function, which lacks authentication verification or privilege validation before executing updates. This creates a path where unauthenticated attackers can manipulate any user account within the WordPress installation simply by knowing a valid user ID and submitting it alongside an attacker-controlled email address. The vulnerability essentially removes the fundamental authentication barriers that normally prevent unauthorized modifications to user accounts, allowing attackers to modify email addresses of any registered users including administrative accounts.
The operational impact of this vulnerability extends beyond simple email modification, as it enables complete account takeover through the exploitation of WordPress's built-in password reset functionality. Once an attacker successfully changes a target user's email address to one under their control, they can initiate the native password reset process which will send reset instructions to the compromised email address. This creates a seamless attack chain where the initial vulnerability leads directly to full account compromise without requiring additional authentication credentials or complex exploitation techniques.
This vulnerability aligns with CWE-285, which addresses insufficient authorization in software systems, and maps to ATT&CK technique T1078.004 for valid accounts and T1566.001 for spearphishing via web applications. The flaw demonstrates a classic case of improper input validation combined with inadequate access control enforcement, where the plugin fails to verify that the requesting user has legitimate authorization to modify the target account. Organizations using affected versions should immediately implement mitigations including disabling the vulnerable AJAX endpoint, implementing proper authentication checks, or upgrading to patched versions that address these access control weaknesses.
The security implications of this vulnerability are particularly severe in environments where administrators use default email addresses or where email-based recovery mechanisms are the primary authentication method. Attackers can leverage this flaw to target high-privilege accounts without requiring knowledge of existing credentials, making it a significant threat to WordPress installations that rely on the plugin for user management functionality. The vulnerability also highlights the importance of validating all user inputs and implementing proper access control checks even for frontend interfaces that appear to be non-critical or public-facing components.