The TrueBooker plugin for WordPress exposes an add_front_user_update AJAX handler to unauthenticated users, allowing them to supply any truebooker_wp_user_id value. The handler passes this identifier directly to WordPress’s wp_update_user function without verifying whether the requester is authenticated or authorized to modify that account. By changing a victim’s email address to an attacker‑controlled address, the attacker can then trigger the native WordPress password reset flow and receive the reset link at their own mailbox, thereby taking full control of the account. This flaw is a classic example of CWE‑639, where an attacker can gain privilege by tampering with ownership references.

The TrueBooker – Appointment Booking and Scheduler System, developed by ThemisTechMount, is vulnerable in all releases up to and including version 1.2.6. Sites running any of these plugin versions and exposing the plugin to public web traffic are at risk.

The vulnerability carries a CVSS score of 9.8, classifying it as critical. The EPSS score is less than 1 %, indicating that, at present, exploitation is unlikely but not impossible. The flaw is not listed in CISA’s KEV catalog. The attack can be carried out simply by sending a crafted POST request to the exposed AJAX endpoint; no authentication is required. Successful exploitation results in full control of the targeted user account, including administrators.