{"vulnerability": "cve-2026-16142", "sightings": [{"uuid": "3451af9b-1de2-43fa-b8d1-f20dde6138ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-16142", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117098704007638210", "content": "CVE-2026-16142 (CRITICAL, CVSS 9.8): TrueBooker WP plugin \u22641.2.6 is vulnerable to auth bypass via user-controlled AJAX handler. Attackers can hijack any account by changing email & triggering password reset. Restrict or disable TrueBooker. https://radar.offseq.com/threat/cve-2026-16142-cwe-639-authorization-bypass-through-user-controlled-key-in-themetechmount-truebooker-17123cd1c5904122 #OffSeq #WordPress #CVE2026_16142", "creation_timestamp": "2026-08-15T09:00:25.933979Z"}, {"uuid": "ae7b1d2b-09ab-4528-82d4-ce1c5093706a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-16142", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mt4cpjezg72c", "content": "TrueBooker WP plugin \u22641.2.6 has a CRITICAL auth bypass (CVE-2026-16142). Attackers can hijack any user via email change & password reset. Disable or restrict plugin access until a fix. https://radar.offseq.com/threat/cve-2026-16142-cwe-639-authorization-bypass-through-user-controlled-key-in-theme...", "creation_timestamp": "2026-08-15T09:00:26.598958Z"}, {"uuid": "48a376a8-61f5-403c-b280-a0d5cc777dce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16142", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mt4g2lvjhh24", "content": "\ud83d\udd34 CVE-2026-16142 - Critical (9.8)\n\nThe TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-16142/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-15T10:00:19.865395Z"}, {"uuid": "945e1bca-a3d3-4d87-b2fe-e99c8bf7dab0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16142", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt4itlksev23", "content": "CVE-2026-16142\nThe TrueBooker plugin for WordPress allows unauthorized users to change any account's email address. This could lead to account takeover if an attacker gains control of the email address associated with an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-15T10:50:05.296789Z"}, {"uuid": "dc0ec5de-1737-4d88-8a9d-3a82e220c5fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16142", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mt5vuthieq2c", "content": "CVE-2026-16142 truebooker-appointment-booking (CVSS Score 9.8) \n\n#WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #hacking #wpsecurity #atomicedge #cybersecurity #malware #vulnerabilityresearch #cve #redteam #proofofconcept", "creation_timestamp": "2026-08-16T00:16:05.855437Z"}]}