CVE-2026-16142: CWE-639 Authorization Bypass Through User-Controlled Key in themetechmount TrueBooker – Appointment Booking and Scheduler System
The TrueBooker WordPress plugin up to version 1.2.6 contains an authorization bypass vulnerability allowing unauthenticated attackers to change any user's email address. This occurs because an AJAX handler accepts arbitrary user IDs without verifying ownership, enabling attackers to hijack accounts via the password reset process.
AI Analysis
Technical Summary
CVE-2026-16142 is an authorization bypass vulnerability in the TrueBooker – Appointment Booking and Scheduler System WordPress plugin. The add_front_user_update() AJAX handler is accessible to unauthenticated users and accepts a user ID parameter that is passed directly to wp_update_user() without verifying authentication or ownership. This flaw allows attackers to change the email address of any WordPress user, including administrators. By changing the email to an attacker-controlled address, the attacker can then trigger the WordPress password reset flow to receive the reset link and take over the targeted account.
Potential Impact
An unauthenticated attacker can take over any WordPress user account, including administrator accounts, by changing the account's email address and then using the password reset functionality. This leads to full compromise of the affected WordPress site with potential for complete control, data theft, or site defacement.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable AJAX handler or disable the TrueBooker plugin if possible to prevent exploitation.
CVE-2026-16142: CWE-639 Authorization Bypass Through User-Controlled Key in themetechmount TrueBooker – Appointment Booking and Scheduler System
Description
The TrueBooker WordPress plugin up to version 1.2.6 contains an authorization bypass vulnerability allowing unauthenticated attackers to change any user's email address. This occurs because an AJAX handler accepts arbitrary user IDs without verifying ownership, enabling attackers to hijack accounts via the password reset process.
CVSS v3.1
Score 9.8critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-16142 is an authorization bypass vulnerability in the TrueBooker – Appointment Booking and Scheduler System WordPress plugin. The add_front_user_update() AJAX handler is accessible to unauthenticated users and accepts a user ID parameter that is passed directly to wp_update_user() without verifying authentication or ownership. This flaw allows attackers to change the email address of any WordPress user, including administrators. By changing the email to an attacker-controlled address, the attacker can then trigger the WordPress password reset flow to receive the reset link and take over the targeted account.
Potential Impact
An unauthenticated attacker can take over any WordPress user account, including administrator accounts, by changing the account's email address and then using the password reset functionality. This leads to full compromise of the affected WordPress site with potential for complete control, data theft, or site defacement.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable AJAX handler or disable the TrueBooker plugin if possible to prevent exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-07-17T17:24:45.954Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a80264cbf8831d539caceb6
Added to database: 08/15/2026, 08:41:48 UTC
Last enriched: 08/15/2026, 08:56:05 UTC
Last updated: 08/15/2026, 10:26:09 UTC
Views: 20
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.