The TrueBooker plugin for WordPress allows an attacker to change any user’s password without authentication by omitting proper authorization checks. This flaw enables unauthenticated users to reset passwords for any account, including administrators, thereby compromising account integrity and potentially all system access. The weakness is a classic missing authorization bug, labeled with CWE‑862.

The affected product is the TrueBooker – Appointment Booking and Scheduler System, a WordPress plugin sold by TheTechMount. All releases up to and including version 1.2.3 are vulnerable; no later versions are known to be affected.

The CVSS score of 9.8 places this vulnerability in the Critical category. Because EPSS data is unavailable, the exact likelihood of exploitation cannot be quantified. Based on the description, it is inferred that the absence of authentication checks permits an attacker to trigger a password reset by sending a crafted HTTP request containing the truebooker_wp_user_id parameter; this implies a high likelihood of exploitation if an attacker can reach the endpoint. Attacks are likely to come from external actors who can send such a request. The issue is not currently listed in the CISA KEV catalog.