Unrated severityNVD Advisory· Published Aug 19, 2026

CVE-2026-18776

Description

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.

Affected products

WordPress/Truebookerllm-fuzzy
Range: <1.2.7

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/4b6abb2d-941b-429f-a480-33d1aafad450/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000