The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers…

The TrueBooker WordPress plugin before version 1.2.4 contains a critical authentication bypass vulnerability in its front-end account handler. The plugin fails to validate account ownership during password reset operations, allowing unauthenticated attackers to set arbitrary passwords on any account. This includes administrator accounts, effectively enabling full site takeover. No authentication or prior privileges are required to exploit this vulnerability. The issue is resolved in version 1.2.4 of the plugin.