## Summary
The TrueBooker – Appointment Booking and Scheduler System WordPress plugin is vulnerable to an authorization bypass (CWE-862) in all versions up to and including 1.2.3. An attacker can modify the email address of arbitrary user accounts (including administrators) and leverage this to reset passwords and take over accounts.
## Technical Details
- Root cause: the plugin does not properly verify that a user is authorized to perform the targeted action.
- Affected action: modification of user email addresses for arbitrary accounts.
- Attack prerequisites: none indicated beyond network access; the issue is described as exploitable by unauthenticated attackers.
- Likely impact chain described: email change → password reset → account access.
## Affected
- TrueBooker – Appointment Booking and Scheduler System WordPress plugin: all versions up to and including 1.2.3.
## Impact
- Unauthenticated account takeover via administrator email modification and subsequent password reset.
- Confidentiality, integrity, and availability impact are indicated as high in the provided CVSS vector (C:H/I:H/A:H).
## Mitigation
1. Upgrade the TrueBooker – Appointment Booking and Scheduler System WordPress plugin to a version that is not affected (i.e., beyond 1.2.3).
2. If immediate upgrade is not possible, restrict access to the WordPress admin surface and monitor for suspicious user email changes and password reset activity.
3. Audit administrator accounts for unexpected email changes and validate recent password reset events.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-862