Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability affects the TrueBooker plugin for WordPress, allowing unauthenticated attackers to take over any user account, including administrators, by changing their email addresses and initiating a password reset. This could lead to a complete compromise of WordPress sites that use this plugin.
- Attackers can seize control of WordPress accounts.
- Affects a popular plugin; confirms site relevance.
- Assess exposure to prevent unauthorized access.
Attack Path
How an attacker could exploit the issue
An attacker can target any user account, including administrators, on a WordPress site using the TrueBooker plugin. By sending a request to a specific handler, an attacker can change a user's email address to one they control. Once the email is changed, the attacker can initiate a password reset to gain full account control.
- No authentication required.
- Arbitrary user email address update.
- Account takeover via password reset.
Live Threat
Current exploitation, exposure, and threat context
An unauthenticated attacker could compromise any WordPress user account, including administrators, by manipulating the account's email address. This allows the attacker to then initiate a password reset, directing the reset link to their own controlled email address and gaining full account control. This is possible when the TrueBooker plugin is active and an attacker can reach the vulnerable AJAX handler.
- User accounts and administrative access.
- Via a specially crafted network request.
- Complete account takeover and data compromise.
Operational Fix
Recommended remediation, mitigation, and detection steps
The WordPress platform owner and the security team are likely responsible for addressing this vulnerability, as it impacts a plugin commonly used for website functionality. The initial focus should be on identifying all instances of the TrueBooker plugin, confirming its reachability and business criticality, and then coordinating remediation efforts with the plugin's vendor or through alternative controls.
- WordPress platform owners are responsible.
- Verify plugin presence and exposure.
- Plan vendor coordination and remediation.
