A critical vulnerability in the TrueBooker plugin allows unauthenticated attackers to change any user email address, facilitating full account takeover via the WordPress password reset mechanism.

This is an authorization bypass vulnerability caused by the add_front_user_update AJAX handler. The function fails to verify user authentication or ownership, allowing unauthenticated attackers to update the email address of any WordPress user, including administrators, to an attacker-controlled address.

By modifying the email address associated with a high-privilege account, an attacker can trigger the native WordPress password reset flow to gain full administrative access. This leads to complete site compromise, potential data theft, and loss of control over the appointment booking system. The CVSS score of 9.8 confirms the critical nature of this flaw.

Immediate Action: Update the TrueBooker plugin to version 1.2.7 or later immediately to resolve the insecure AJAX handler implementation.

Proactive Monitoring: Inspect user account modification logs or audit trails for unexpected changes to administrator email addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to restrict access to the add_front_user_update AJAX endpoint to authorized users only.

Public Exploit Available: No (unknown)

Administrators must prioritize updating the TrueBooker plugin to version 1.2.7. Failure to patch this vulnerability leaves the application exposed to simple, unauthenticated account takeover attacks that can result in total system compromise.