The TrueBooker WordPress plugin does not verify that a requesting user owns the account when resetting a password through its-end handlers. This failure is a CWE-269 vulnerability, representing an authorization bypass through privilege escalation. As a result, an unauthenticated attacker can reset any user’s password—including administrators—without credentials, allowing the attacker to assume administrative privileges on the site. Once privileged, the attacker may modify content, install new plugins, or otherwise disrupt or subvert site operations.

The vulnerability affects the TrueBooker WordPress booking plugin, specifically all releases prior to version 1.2.4.

The CVSS score of 9.8 indicates critical severity, while an EPSS score of less than 1% suggests low current exploitation probability; the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a publicly accessible password-reset form on the front end, where an unauthenticated user can specify a target username and trigger the reset. If a malicious actor determines a target administrator account, they can simply submit a reset request and immediately assume full administrative privileges.