CVE-2026-16142

The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the addfrontuserupdate AJAX handler being registered for unauthenticated users and accepting an arbitrary truebookerwpuserid value, which is passed directly to...

CVE-2026-16142

creationtimestamp| type| source ---|---|--- 2026-08-15 09:00:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117098704007638210 2026-08-15 09:00:26+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mt4cpjezg72c 2026-08-15 10:00:19+00:00| seen|...