CVE-2026-16142: CWE-639 Authorization Bypass Through User-Controlled Key in themetechmount TrueBooker – Appointment Booking and Scheduler System
The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() AJAX handler being registered for unauthenticated users and accepting an arbitrary truebooker_wp_user_id value, which is passed directly to wp_update_user() without verifying authentication or ownership. This makes it possible for unauthenticated attackers to change any WordPress user account email address, including an administrator, by submitting the target user ID and an attacker-controlled email address. An attacker can then use the native WordPress password reset flow to receive the reset link at the attacker-controlled email address and take over the account.
AI Analysis
Technical Summary
CVE-2026-16142 is an authorization bypass vulnerability in the TrueBooker – Appointment Booking and Scheduler System WordPress plugin. The flaw exists because the add_front_user_update() AJAX handler is registered for unauthenticated users and accepts a user ID parameter that is passed directly to wp_update_user() without authentication or ownership checks. This allows unauthenticated attackers to change the email address of any WordPress user account by submitting the target user ID and an attacker-controlled email address. The attacker can then use WordPress's password reset functionality to receive the reset link at the attacker-controlled email and take over the account. The vulnerability affects all versions up to and including 1.2.6 and has a CVSS 3.1 score of 9.8, indicating critical severity.
Potential Impact
An unauthenticated attacker can change the email address of any WordPress user, including administrators, enabling account takeover via the password reset mechanism. This compromises confidentiality, integrity, and availability of affected WordPress accounts, potentially leading to full site compromise.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable AJAX handler if possible or disable the TrueBooker plugin. Monitor vendor channels for updates and apply patches promptly once released.
CVE-2026-16142: CWE-639 Authorization Bypass Through User-Controlled Key in themetechmount TrueBooker – Appointment Booking and Scheduler System
Description
The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() AJAX handler being registered for unauthenticated users and accepting an arbitrary truebooker_wp_user_id value, which is passed directly to wp_update_user() without verifying authentication or ownership. This makes it possible for unauthenticated attackers to change any WordPress user account email address, including an administrator, by submitting the target user ID and an attacker-controlled email address. An attacker can then use the native WordPress password reset flow to receive the reset link at the attacker-controlled email address and take over the account.
CVSS v3.1
Score 9.8critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-16142 is an authorization bypass vulnerability in the TrueBooker – Appointment Booking and Scheduler System WordPress plugin. The flaw exists because the add_front_user_update() AJAX handler is registered for unauthenticated users and accepts a user ID parameter that is passed directly to wp_update_user() without authentication or ownership checks. This allows unauthenticated attackers to change the email address of any WordPress user account by submitting the target user ID and an attacker-controlled email address. The attacker can then use WordPress's password reset functionality to receive the reset link at the attacker-controlled email and take over the account. The vulnerability affects all versions up to and including 1.2.6 and has a CVSS 3.1 score of 9.8, indicating critical severity.
Potential Impact
An unauthenticated attacker can change the email address of any WordPress user, including administrators, enabling account takeover via the password reset mechanism. This compromises confidentiality, integrity, and availability of affected WordPress accounts, potentially leading to full site compromise.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable AJAX handler if possible or disable the TrueBooker plugin. Monitor vendor channels for updates and apply patches promptly once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-07-17T17:24:45.954Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a80264cbf8831d539caceb6
Added to database: 08/15/2026, 08:41:48 UTC
Last enriched: 08/22/2026, 13:18:55 UTC
Last updated: 09/06/2026, 10:52:07 UTC
Views: 90
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.