A critical vulnerability in the TrueBooker WordPress plugin allows unauthenticated remote attackers to perform a full site takeover by resetting arbitrary user passwords.

The plugin suffers from improper privilege management where front-end account handlers do not verify user identity during the password reset process. This flaw allows an unauthenticated attacker to supply a target username and set a new password, granting them full unauthorized access to the victim's account.

This vulnerability carries a CVSS score of 9.8, reflecting its critical severity. A successful exploit grants an attacker immediate administrative access, which can be used to deploy malicious scripts, exfiltrate sensitive customer data, or deface the website. Such an incident poses a significant threat to organizational integrity and user privacy.

Immediate Action: Update the TrueBooker WordPress plugin to version 1.2.4 or later immediately to apply the necessary security validation.

Proactive Monitoring: Review WordPress user access logs for suspicious password reset activity or unauthorized administrative logins.

Compensating Controls: If an immediate update is not possible, disable the TrueBooker plugin entirely until the patch is applied, or implement a Web Application Firewall (WAF) rule to block unauthorized access to the plugin's front-end password reset endpoints.

Public Exploit Available: Unknown.

Given the ease of exploitation and the potential for full site compromise, administrators must prioritize this update. Ensure that all plugin versions are audited and updated to 1.2.4 to eliminate this critical account takeover vector.