CVE-2026-14365
CRITICAL
CVSS 9.8
Truebooker Appointment Booking And Scheduler System
Verified Advisory
Authorization bypass enabling arbitrary password reset in TrueBooker plugin for WordPress (CVE-2026-14365)
WordPress
Authentication Bypass
Truebooker Appointment Booking And Scheduler System
Wordpress Plugin
Themetechmount
The TrueBooker - Appointment Booking and Scheduler System plugin for WordPress contains a missing authorization flaw that allows unauthenticated attackers to reset the password of any user account, including administrators, via the `truebooker_wp_user_id` parameter. Exploitation requires no credentials or user interaction and can result in full account takeover, including administrative access to the WordPress installation.
Affected versions:
- <= 1.2.3
We recommend updating to: 1.2.4.
CVSS 9.8 · our assessment: act_now
Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/afe10c10-cace-4ce4-a813-6fda04c8d3dd?source=cve
Details: https://vuln.today/cve/CVE-2026-14365
Verified by vuln.today against published advisories.
Affected versions
- – <= 1.2.3
Fixed in: 1.2.4