CVE-2026-18315

creationtimestamp| type| source ---|---|--- 2026-08-19 20:11:57+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mthk3xuqgd2u 2026-08-20 00:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mthz3giigf2u 2026-08-21 00:00:08+00:00| published-proof-of-concept|...

CVE-2026-18315

The TrueBooker – Appointment Booking and Scheduler System WordPress plugin (all versions ≤ 1.2.6 ) contains an unauthenticated authorization bypass in the admin_user_create_cus AJAX handler. The handler passes the attacker-controlled truebooker_wp_user_id parameter directly to wp_update_user with...