CVE-2026-16142: TrueBooker WordPress Plugin Unauthenticated Account Takeover

Executive Summary

A critical unauthenticated account takeover vulnerability (CVE-2026-16142) has been disclosed in the TrueBooker plugin for WordPress. The flaw carries a CVSS score of 9.8 and allows any unauthenticated attacker to take over arbitrary user accounts — including administrator accounts — without needing any credentials.

CVSS Score: 9.8 (Critical)

The vulnerability exists in the plugin's add_front_user_update() AJAX handler, which is registered for unauthenticated users and accepts an attacker-controlled truebooker_wp_user_id parameter. By passing any WordPress user ID in this parameter, an attacker can modify account details for that user, effectively seizing control of the account.

Vulnerability Overview

Affected Versions

Technical Details

The root cause is the add_front_user_update() function being registered as an AJAX action available to unauthenticated (non-logged-in) users. The handler accepts a truebooker_wp_user_id parameter directly from user input and uses it without any authorization check to identify which WordPress user account to update.

An attacker can supply any valid WordPress user ID — including the site administrator's — and submit arbitrary update data, effectively overwriting account credentials or email addresses to gain full access.

Attack Sequence

1. Attacker enumerates WordPress user IDs (commonly author=1 leaks admin ID)
2. Attacker crafts POST request to wp-admin/admin-ajax.php
3. Action: add_front_user_update with truebooker_wp_user_id=<target_id>
4. Attacker supplies new email address or password for target account
5. Plugin updates target user account without verifying requester identity
6. Attacker logs in to compromised account — including admin if targeted

Impact of Successful Exploitation

Immediate Remediation

Step 1: Update or Deactivate TrueBooker

Check for an updated version of TrueBooker that resolves this vulnerability. If no patch is available from the plugin vendor, deactivate and remove the plugin immediately.

# Via WP-CLI — check installed version
wp plugin get truebooker --field=version
 
# Update if a patched version is available
wp plugin update truebooker
 
# If no patch is available, deactivate immediately
wp plugin deactivate truebooker
wp plugin delete truebooker

Step 2: Audit for Account Compromise

# Check for recently modified admin accounts
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
 
# Review user meta for unexpected changes
wp db query "SELECT user_id, meta_key, meta_value FROM wp_usermeta WHERE meta_key='last_update' ORDER BY meta_value DESC LIMIT 20;"
 
# Check WordPress auth log if available
wp db query "SELECT * FROM wp_options WHERE option_name LIKE '%session%';"

Step 3: Reset All Administrative Credentials

# Reset all administrator passwords
wp user list --role=administrator --field=ID | xargs -I{} wp user update {} --user_pass=$(openssl rand -base64 16)
 
# Regenerate WordPress secret keys
wp config shuffle-salts
 
# Invalidate all active sessions
wp eval 'delete_option("auth_key"); wp_cache_flush();'

Step 4: Block the Vulnerable AJAX Action at WAF

If patching is not immediately possible, block requests to the vulnerable AJAX action:

# Nginx — block the vulnerable action
location /wp-admin/admin-ajax.php {
    if ($arg_action = "add_front_user_update") {
        return 403;
    }
}

Detection Indicators

Post-Remediation Steps

1. Remove or update TrueBooker to a patched version
2. Audit all administrator accounts for unauthorized changes
3. Reset all admin passwords and regenerate WordPress secret keys
4. Invalidate all active sessions to force reauthentication
5. Review recent content changes for unauthorized modifications
6. Deploy a WAF (Wordfence, Sucuri) to monitor future AJAX abuse
7. Enable two-factor authentication on all administrator accounts

References

• NIST NVD — CVE-2026-16142

Related Reading

• CVE-2026-18438: Templately WordPress Plugin Remote Code Execution
• CVE-2026-15142: Real Estate Manager Pro Privilege Escalation