The TrueBooker WordPress plugin prior to version 1.2.7 lacks proper authorization validation on some AJAX endpoints. This weakness permits unauthenticated attackers to modify the email addresses of any user, including administrators. By changing the email address, attackers can trigger the password reset flow to gain control over the targeted accounts. The vulnerability is classified under CWE-269 (Improper Privilege Management) and CWE-284 (Improper Access Control). It has a CVSS v3.1 score of 9.8, indicating a critical severity with network attack vector, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact.

Successful exploitation allows unauthenticated attackers to hijack user accounts, including administrator accounts, by changing their email addresses and resetting passwords. This leads to complete compromise of affected user accounts and potentially the entire WordPress site managed by the TrueBooker plugin.

Upgrade the TrueBooker plugin to version 1.2.7 or later, where proper authorization checks have been implemented to prevent unauthorized email address changes via AJAX actions. No other mitigations are specified. Patch status is confirmed by the existence of fixed version 1.2.7.