The TrueBooker appointment booking plugin for WordPress is vulnerable to an unauthenticated authorization bypass that allows an attacker to supply a user ID to a privileged Ajax handler, which then updates that user’s email address. By doing so, the attacker can trigger the WordPress lost‑password workflow and fully take over the target account, including administrators. This flaw originates from a lack of authentication or capability checks in the admin_user_create_cus handler and is classified as CWE‑639.

The vulnerability affects the themetechmount TrueBooker – Appointment Booking and Scheduler System plugin for WordPress, all releases up to and including version 1.2.6. No other versions have been identified as impacted.

The CVSS score of 9.8 indicates a critical severity, and the exploit requires no authentication. The EPSS score is currently not available, and the issue is not listed in the CISA KEV catalog, but the lack of safeguards and the critical impact recommend immediate attention. An unauthenticated attacker could execute the vulnerable Ajax request directly, bypassing any role or capability checks and achieving full control of the compromised account.