CVE-2026-18315 Overview
CVE-2026-18315 is an authorization bypass vulnerability in the TrueBooker – Appointment Booking and Scheduler System plugin for WordPress. The flaw affects all versions up to and including 1.2.6. The admin_user_create_cus AJAX handler processes the attacker-supplied truebooker_wp_user_id parameter without performing authentication or capability checks. Unauthenticated attackers can overwrite the email address of any WordPress user, including administrators, then trigger the standard lost-password workflow to complete account takeover. The vulnerability maps to [CWE-639] Authorization Bypass Through User-Controlled Key.
Critical Impact
Unauthenticated attackers can hijack administrator accounts on any WordPress site running TrueBooker 1.2.6 or earlier, leading to full site compromise.
Affected Products
- TrueBooker – Appointment Booking and Scheduler System plugin for WordPress
- All plugin versions from initial release through 1.2.6
- Any WordPress installation with the vulnerable plugin activated
Discovery Timeline
- 2026-08-19 - CVE-2026-18315 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-18315
Vulnerability Analysis
The vulnerability resides in the plugin's admin_user_create_cus AJAX handler defined in function_ajax.php. WordPress AJAX endpoints registered via wp_ajax_nopriv_ are reachable by unauthenticated visitors. The handler accepts a truebooker_wp_user_id parameter from the request body and passes it directly into wp_update_user() along with an attacker-controlled email address.
Because the handler contains no current_user_can() capability check and no nonce verification, any anonymous request can target arbitrary user IDs. Setting truebooker_wp_user_id=1 rewrites the primary administrator's email. The attacker then submits the WordPress lost-password form, receives the reset link at their own inbox, and sets a new administrator password.
Root Cause
The root cause is missing authorization enforcement on a privileged operation. The plugin trusts the truebooker_wp_user_id parameter as a user-controlled key without validating that the requester owns or has rights to modify the referenced account. This pattern is the defining characteristic of [CWE-639].
Attack Vector
The exploit is remote and requires no privileges or user interaction. An attacker sends a single HTTP POST request to /wp-admin/admin-ajax.php specifying action=admin_user_create_cus, a target user ID such as 1, and an attacker-controlled email address. After the update succeeds, the attacker requests a password reset for the targeted username and completes login with the newly issued credentials. No verified proof-of-concept code is published; refer to the Wordfence Vulnerability Report and the WordPress Plugin AJAX Function for the vulnerable source.
Detection Methods for CVE-2026-18315
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php containing action=admin_user_create_cus from unauthenticated sessions.
- Unexpected changes to the user_email field in the wp_users table, particularly for accounts with the administrator role.
- Password reset emails issued to addresses that do not match previously recorded user email history.
- New administrator logins from unfamiliar IP addresses shortly after an email change event.
Detection Strategies
- Enable WordPress audit logging to capture every invocation of wp_update_user and correlate the modified user ID with the requester's session.
- Alert on any admin-ajax.php request whose action value is admin_user_create_cus when the response status is 200.
- Monitor web access logs for high-volume enumeration of user IDs 1 through 10 against the vulnerable endpoint.
Monitoring Recommendations
- Ingest WordPress access and application logs into a centralized SIEM for correlation across sites and hosts.
- Track baseline password-reset request rates and alert on statistically significant spikes.
- Continuously inventory installed WordPress plugins and versions to identify hosts still running TrueBooker 1.2.6 or earlier.
How to Mitigate CVE-2026-18315
Immediate Actions Required
- Update the TrueBooker plugin to the version released after the WordPress Plugin Changeset Update as soon as it is available.
- If a patched version is not yet deployable, deactivate and remove the plugin from all WordPress installations.
- Audit the wp_users table for unauthorized email changes and reset passwords for every administrator account.
- Invalidate all active sessions with wp_destroy_all_sessions() for privileged users.
Patch Information
The plugin repository reflects a fix in the WordPress Plugin Changeset Update. Site operators should install the corresponding released version from the WordPress plugin directory. Verify the deployed version via the plugin management screen after update.
Workarounds
- Block requests to /wp-admin/admin-ajax.php where the action parameter equals admin_user_create_cus at the web application firewall until the patch is applied.
- Restrict access to admin-ajax.php for unauthenticated users using server-level rules where feasible without breaking legitimate front-end functionality.
- Enforce multi-factor authentication on all WordPress administrator accounts so a stolen password alone cannot complete takeover.
# Example WAF rule (ModSecurity) to block the vulnerable AJAX action
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
"chain,phase:2,deny,status:403,id:1026183150,msg:'Block TrueBooker CVE-2026-18315'"
SecRule ARGS:action "@streq admin_user_create_cus"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
