TrueBooker CVE-2026-14364

The only prerequisite is network reachability of a WordPress site running TrueBooker version 1.2.3 or earlier with the plugin active - no authentication, credentials, user interaction, or non-default configuration is required (AV:N/AC:L/PR:N/UI:N against default installs). Exploitation targets the plugin's own password-reset functionality, so the site must have TrueBooker installed and enabled; the flaw does not affect core WordPress reset behavior. The main limiting factor is simply exposure of the vulnerable plugin, meaning any publicly accessible install is at risk.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) describes a remote, unauthenticated, no-interaction, low-complexity attack with total impact - the maximum realistic risk profile for a WordPress plugin flaw. No EPSS score, KEV listing, or SSVC decision data was provided, so exploitation-probability and automatability signals cannot be independently corroborated; the assessment rests on the CVSS vector and the Wordfence description rather than observed exploitation. There is no evidence of active exploitation or public POC at this time, so this is a genuine high-priority issue based on ease-of-exploit and impact rather than a confirmed in-the-wild threat. The 'Information Disclosure' tag is somewhat mislabeled - the actual impact is authentication bypass/account takeover, which is more severe than disclosure alone.

An attacker sends a crafted request to the plugin's password-reset handler specifying the administrator account, and because no identity/token validation occurs, the plugin sets the attacker-supplied password on that account. The attacker then logs in to /wp-admin with full administrator privileges and can install malicious plugins, exfiltrate data, or deface the site. No user interaction or prior credentials are required (AV:N/AC:L/PR:N/UI:N); no public POC has been identified at time of analysis.