The vulnerability in the TrueBooker – Appointment Booking and Scheduler System plugin for WordPress allows an unauthenticated attacker to modify the email addresses of any user account, including administrators, through the improperly secured 'admin_addcustomer' AJAX action. By changing an administrator’s email, the attacker can trigger a password reset and subsequently gain full access to that account. This weakness is a classic example of authorization bypass (CWE‑862) and results in compromise of confidentiality, integrity, and availability of the site’s administrative control.

All installations of the TrueBooker plugin for WordPress with version 1.2.3 or earlier are affected. Any site running the plugin at these or earlier releases is vulnerable until it is updated to 1.2.4 or later.

The CVSS score of 9.8 marks this flaw as critical. The EPSS score is below 1%, indicating a very low probability of known exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the attack vector is straightforward: an unauthenticated request to the vulnerable AJAX endpoint can be sent from any host. Because the bypass does not require authentication or privileged credentials, a single unauthenticated request suffices to initiate the email change and subsequent reset process. This low barrier to exploitation necessitates immediate attention.