CVE-2026-18776CWE-284broken-access-control

CVE-2026-18776

Critical · published August 19, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
41.8
In the wild
Unconfirmed
What it is

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00498 · 41.8th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-08-19T10:17Z
References (1)
https://wpscan.com/vulnerability/4b6abb2d-941b-429f-a480-33d1aafad450/ · [email protected]
EPSS history
Timeline
  • 19 AUG 06:00Z
    TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJAX Actions
    cvelistv5