CVE-2026-18315 affects the TrueBooker – Appointment Booking and Scheduler System WordPress plugin in all versions up to and including 1.2.6. The vulnerability arises from the admin_user_create_cus AJAX handler which does not perform any authentication or capability checks before accepting the truebooker_wp_user_id parameter and passing it directly to wp_update_user. This allows unauthenticated attackers to overwrite the email address of any WordPress user, including administrators. By changing the email, attackers can then use the standard WordPress lost-password functionality to reset the password and fully take over the targeted account. The CVSS v3.1 base score is 9.8, reflecting critical impact with network attack vector, no privileges required, no user interaction, and high confidentiality, integrity, and availability impacts.

An unauthenticated attacker can overwrite the email address of any WordPress user, including administrators, enabling full account takeover via the password reset mechanism. This compromises the confidentiality, integrity, and availability of affected WordPress accounts and potentially the entire site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the AJAX handler if possible or disable the TrueBooker plugin to prevent exploitation.