WordPress Plugin Missing Authorization in AJAX Actions

CVE-2026-18776 affects the TrueBooker WordPress plugin versions before 1.2.7, exposing a critical authorization bypass vulnerability in AJAX actions. The plugin fails to properly validate user permissions before processing certain AJAX requests, allowing completely unauthenticated attackers to modify email addresses for any user account—including administrators. By changing an administrator's email address, attackers can leverage the password reset flow to gain complete account takeover. This vulnerability is particularly dangerous because it requires no user interaction, no authentication, and affects WordPress installations that depend on this plugin, potentially impacting thousands of websites managing bookings and user accounts.

While this specific CVE currently has 0 matching Casky skills, practitioners using Casky's Claude AI-powered platform would detect the underlying attack patterns through behavioral analysis of AJAX request anomalies and privilege escalation attempts mapped to MITRE ATT&CK. The attack chain—unauthenticated access to account modification (T1078: Valid Accounts), unauthorized privilege changes, and credential reset abuse—represents a classic authorization flaw pattern. Extended reasoning across Casky's 754 security skills would flag suspicious AJAX calls lacking proper authentication tokens, mass account modification requests from single sources, and rapid email-to-password reset sequences that deviate from normal user behavior, enabling defenders to identify exploitation attempts even before signature-based detection catches them.