SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-18776

CRITICAL · CVSS 9.8 EPSS 0.34%

Source: NVD + CISA KEV + EPSS · Published 2026-08-19 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

The TrueBooker WordPress plugin prior to version 1.2.7 is vulnerable due to inadequate authorization checks in certain AJAX actions, enabling unauthenticated users to alter the email addresses of any user, including administrators. This flaw can lead to account takeover through the password reset process. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate the risk of unauthorized access.

CVE
CVE-2026-18776
Severity
CRITICAL
CVSS
9.8
EPSS
0.34%
WordPress

Original NVD Description

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.