TrueBooker WordPress Plugin Unauthenticated Account Takeover

Technical Analysis

CVE-2026-16142 stems from the add_front_user_update() AJAX handler in TrueBooker, which is registered for unauthenticated (nopriv) access and passes an attacker-supplied truebooker_wp_user_id and email value directly to wp_update_user() without verifying authentication, capability, or object ownership. This allows any unauthenticated attacker to overwrite the email address of an arbitrary WordPress user account, including administrators, then trigger the standard WordPress password reset flow to receive the reset link at an attacker-controlled address, achieving full account takeover. The vulnerability has a CVSS score of 9.8, reflecting its low complexity, no authentication requirement, and high impact on confidentiality, integrity, and availability. Exploitation requires only a single crafted HTTP request to admin-ajax.php with the target user ID and attacker email, making mass automated exploitation trivial. If a compromised WordPress site is used to host, orchestrate, or serve content/configuration for AI agent workflows (e.g., a RAG knowledge base, agent-facing API endpoint, or CMS-driven prompt/data source), full admin takeover could allow attackers to poison agent-consumed content, exfiltrate stored API keys/secrets in the WordPress database, or pivot into connected agent infrastructure.

Affected Systems

WordPress sites running the TrueBooker plugin, all versions up to and including 1.2.6

Indicators of Compromise

• POST requests to /wp-admin/admin-ajax.php with action=add_front_user_update
• Unusual truebooker_wp_user_id parameter values targeting administrator user IDs (e.g., user ID 1)
• Unexpected changes to WordPress user email addresses in wp_users table
• Password reset emails triggered shortly after unexplained email address changes

Remediation Steps

1. 1

   Update or remove the plugin

   Update TrueBooker to a patched version once available, or disable/remove the plugin entirely if no fix has been released.

2. 2

   Audit user accounts

   Review all WordPress user accounts, especially administrators, for unauthorized email address changes and recent password resets.

3. 3

   Force password resets and enable MFA

   Force a password reset for all admin and privileged accounts and enable multi-factor authentication to reduce impact of future account takeover attempts.

4. 4

   Restrict AJAX endpoint access

   Use a WAF rule to block or monitor unauthenticated requests to admin-ajax.php with the add_front_user_update action until patched.

5. 5

   Monitor logs for exploitation attempts

   Review web server and WordPress activity logs for suspicious POST requests to admin-ajax.php referencing truebooker_wp_user_id and unexpected email domains.