CVE-2026-14364
CRITICAL
CVSS 9.8
Truebooker Appointment Booking And Scheduler System
Verified Advisory
Unauthenticated arbitrary password reset in TrueBooker WordPress plugin (CVE-2026-14364)
WordPress
Information Disclosure
Truebooker Appointment Booking And Scheduler System
Wordpress Plugin
Themetechmount
The TrueBooker - Appointment Booking and Scheduler System plugin for WordPress fails to properly validate a user's identity before resetting their password. Unauthenticated attackers can exploit this flaw to reset the password of any user account, including administrator accounts, and gain full access. This constitutes a complete account takeover risk requiring no prior authentication or user interaction.
Affected versions:
- <= 1.2.3
We recommend updating to: 1.2.4.
CVSS 9.8 · our assessment: act_now
Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/f441477e-35b8-42ae-b71c-3fdba126021b?source=cve
Details: https://vuln.today/cve/CVE-2026-14364
Verified by vuln.today against published advisories.
Affected versions
- – <= 1.2.3
Fixed in: 1.2.4