Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability has been identified in the TrueBooker WordPress plugin, which handles appointment bookings. The flaw allows unauthenticated attackers to bypass authorization checks, potentially leading to the takeover of any user account, including administrative ones, by altering their email addresses and initiating a password reset. This could compromise sensitive user data and site control.
- Unauthenticated attackers can take over any WordPress account.
- This plugin is often used for public-facing booking systems.
- Confirm if this booking plugin is in use and assess exposure.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this vulnerability by sending a crafted request to the vulnerable WordPress site. The request targets a specific AJAX handler within the TrueBooker plugin that, due to a missing authentication check, allows the attacker to specify any WordPress user ID. By manipulating a user ID and providing an attacker-controlled email address, the attacker can overwrite a legitimate user's email. Subsequently, the attacker can initiate the standard WordPress password reset process for that user, gaining full account takeover capabilities.
- No special access needed.
- Triggers via AJAX handler.
- Leads to account takeover.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow unauthenticated attackers to take over any WordPress user account, including administrator accounts. This is possible because the plugin improperly handles user identification when creating new customers, enabling attackers to modify a user's email address and then initiate the password reset process.
- User email addresses and account access.
- Unauthenticated AJAX handler misuse.
- Full account takeover possible.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability affects the TrueBooker WordPress plugin, placing responsibility on the website's owner or administrator, and potentially the platform or infrastructure team managing the WordPress instance. The first step is to identify all WordPress sites using the plugin, confirm if they are internet-facing and critical, and then determine the specific team or individual accountable for managing that site's plugins.
- Website owners/administrators own the issue.
- Verify plugin reachability and business criticality.
- Plan remediation based on identified risk.
