CVE case study
CVE-2026-18776: Unauthenticated Account Takeover in TrueBooker via AJAX Actions
TrueBooker Appointment Booking before 1.2.7 missed authorization checks in several AJAX actions, letting an unauthenticated user change any account's email and take it over through the password-reset flow. Version 1.2.7 adds the checks.
- Weakness
- CWE-269
- Affected
- TrueBooker Appointment Booking earlier than 1.2.7
- Remediation state
- Upgrade to TrueBooker Appointment Booking 1.2.7 or later
- Advisory published
- 17 Aug 2026
Why it matters
Several of TrueBooker's AJAX actions did not verify that the caller was allowed to run them. Before version 1.2.7, an unauthenticated request could change the email address on any account, including an administrator's.
Once the email is changed, the standard WordPress password-reset flow completes the takeover. The public record scores this Critical at 9.8; version 1.2.7 adds the missing authorization checks.