CVE-2026-18776: TrueBooker Auth Bypass Vulnerability

CVE-2026-18776 Overview

CVE-2026-18776 is a broken access control vulnerability in the TrueBooker WordPress plugin versions before 1.2.7. The plugin fails to enforce authorization checks on several AJAX actions. Unauthenticated attackers can invoke these actions to change the email address of any registered user, including administrators. After changing the target's email, the attacker triggers the WordPress password reset flow to receive the reset link at an attacker-controlled address. This chain results in a full account takeover of any account on the site, including administrator accounts, which grants complete control of the WordPress instance.

Critical Impact
Unauthenticated attackers can take over any WordPress administrator account on sites running TrueBooker before version 1.2.7, leading to full site compromise.

Affected Products

TrueBooker WordPress plugin versions prior to 1.2.7
WordPress sites with TrueBooker installed and activated
Any environment exposing the plugin's AJAX endpoints to the public internet

Discovery Timeline

2026-08-19 - CVE-2026-18776 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-18776

Vulnerability Analysis

The TrueBooker plugin registers AJAX actions that modify user records. These handlers do not verify the caller's capabilities or validate that the request originates from an authorized session. The affected endpoints accept a target user identifier and a new email address as parameters. Because WordPress AJAX actions prefixed with wp_ajax_nopriv_ are reachable without authentication, an unauthenticated HTTP request to /wp-admin/admin-ajax.php reaches the vulnerable handler. The handler then updates the target user's email in the wp_users table without checking whether the requester has permission to modify that account.

An attacker submits the modified email for the administrator account, then requests a password reset through the standard WordPress login form. WordPress sends the reset link to the newly attacker-controlled email address. The attacker completes the reset and authenticates as the administrator.

Root Cause

The root cause is missing authorization enforcement on privileged AJAX actions, tracked as [CWE-284] Improper Access Control. The plugin neither calls current_user_can() before modifying user data nor verifies an AJAX nonce with check_ajax_referer(). The handler treats any incoming request as authorized to change arbitrary user email addresses.

Attack Vector

The attack is remote, requires no privileges, and needs no user interaction. The attacker sends a crafted POST request to the plugin's vulnerable AJAX action supplying the administrator's user ID and an attacker-controlled email. The attacker then submits the wp-login.php?action=lostpassword form and receives the password reset link. Refer to the WPScan Vulnerability Report for endpoint-level details.

// Example exploitation flow (conceptual, no verified PoC available)
// 1. POST to /wp-admin/admin-ajax.php with the vulnerable action parameter,
//    the target administrator user ID, and an attacker-controlled email.
// 2. Submit /wp-login.php?action=lostpassword for the admin username.
// 3. Receive reset link at the attacker email and set a new password.

Detection Methods for CVE-2026-18776

Indicators of Compromise

Unexpected changes to the user_email field for administrator accounts in wp_users
Password reset emails sent to unknown addresses immediately after AJAX requests to admin-ajax.php
New administrator logins from unfamiliar IP addresses or user agents
WordPress user_activation_key values generated for privileged accounts without a corresponding user request

Detection Strategies

Inspect web server access logs for unauthenticated POST requests to /wp-admin/admin-ajax.php referencing TrueBooker action names
Correlate email change events in the WordPress database with subsequent password reset requests for the same accounts
Alert on sequences where an AJAX request is followed within minutes by a lostpassword submission and a successful administrator login

Monitoring Recommendations

Enable WordPress audit logging to record profile changes, password resets, and role modifications
Forward WordPress and web server logs to a centralized platform for retention and query
Monitor outbound mail logs for reset emails sent to domains outside the organization's expected recipients

How to Mitigate CVE-2026-18776

Immediate Actions Required

Update the TrueBooker plugin to version 1.2.7 or later on every affected site
Audit all administrator accounts for unauthorized email changes and revert any that are not legitimate
Force a password reset for all administrator and privileged accounts after patching
Review recent logins and revoke active sessions using a plugin or by rotating authentication salts in wp-config.php

Patch Information

The vendor addressed the flaw in TrueBooker version 1.2.7 by adding authorization checks to the affected AJAX handlers. Site operators should install this release from the WordPress plugin repository. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Deactivate and remove the TrueBooker plugin until the update can be applied
Restrict access to /wp-admin/admin-ajax.php through a web application firewall rule that blocks the vulnerable action names
Limit access to the WordPress admin area by IP allowlist at the web server or WAF layer

bash

# Example WAF rule concept: block unauthenticated POSTs referencing the vulnerable action
# Replace <truebooker_action> with the specific action name from the advisory
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026018776,msg:'Block TrueBooker CVE-2026-18776'"
SecRule ARGS:action "@rx ^<truebooker_action>$" \
  "chain"
SecRule &REQUEST_COOKIES:wordpress_logged_in_ "@eq 0"