A critical authorization bypass vulnerability in the TrueBooker plugin enables unauthenticated attackers to modify user credentials, potentially leading to total site compromise.

This is a missing authorization vulnerability (CWE-862) where the plugin fails to verify the identity or permissions of users before executing sensitive actions. Unauthenticated attackers can exploit this to change the passwords of arbitrary user accounts, including administrators.

The CVSS score of 9.8 reflects the high severity of this bypass, which permits full account takeovers without requiring prior authentication. Successful exploitation grants attackers the ability to exfiltrate data, modify bookings, or gain persistent administrative access, resulting in complete loss of control over the WordPress application.

Immediate Action: Update the TrueBooker – Appointment Booking and Scheduler System plugin to version 1.2.4 or higher to resolve the authorization logic error.

Proactive Monitoring: Monitor server access logs for requests directed at plugin-specific password modification endpoints that do not originate from authenticated user sessions.

Compensating Controls: Deactivate the plugin if an immediate update is not feasible to eliminate the exposure window for this authorization flaw.

Public Exploit Available: Unknown

Security teams must treat this vulnerability with the highest urgency. Applying the update to version 1.2.4 is essential to restore authorization controls and prevent unauthorized users from hijacking administrative sessions.