WordPress - Truebooker – Appointment Booking And Scheduler System - CRITICAL - CVE-2026-16142. The TrueBooker plugin for WordPress is susceptible to unauthorized account takeover due to a flaw in its AJAX handler, add_front_user_update(). This vulnerability allows unauthenticated users to submit arbitrary values for the truebooker_wp_user_id, which are then processed without proper authentication checks. Consequently, an attacker can change the email address associated with any WordPress user account, even administrators. By exploiting this weakness, an attacker can receive a password reset link at the modified email address, facilitating account takeover. Versions up to and including 1.2.6 are affected, highlighting the critical need for users to update and secure their installations.