What is the CVSS score of CVE-2026-14545?

CVE-2026-14545 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-14545?

Yes, a public proof-of-concept exploit is available for CVE-2026-14545. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-14545?

Yes, a patch is available for CVE-2026-14545. Update the affected software to the latest version immediately.

TrueBooker CVE-2026-14545

EUVD-2026-49698 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-28 WPScan

GHSA-h3v6-mwr7-vpq3

WordPress Privilege Escalation Truebooker Unknown

9.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Remote network attack with no privileges or user interaction, leading to full compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 14:40 vuln.today

CVSS changed

Jul 28, 2026 - 14:37 NVD

9.8 (CRITICAL)

Patch available

Jul 28, 2026 - 07:01 EUVD

CVE Published

Jul 28, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 28, 2026 - 06:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.

Articles & Coverage 2

News 19 New WordPress Vulnerabilities - 2 Critical, 17 High Jul 29, 2026 News Critical Vulnerability in WordPress - CVE-2026-14545 Jul 28, 2026

AnalysisAI

Account takeover in TrueBooker WordPress plugin before 1.2.4 enables unauthenticated attackers to reset any user’s password via a front-end handler lacking ownership validation, compromising the entire site. Public proof-of-concept exploit code is available, though EPSS exploitation probability remains low (0.14%) and no CISA KEV listing confirms active exploitation.

Technical ContextAI

The TrueBooker WordPress plugin provides a front-end account management interface that includes password reset functionality. Due to CWE-269 (Improper Privilege Management), the handler does not verify that the requestor owns the target account before setting a new password. This allows an attacker to bypass WordPress’s built-in authentication controls. The identified CPE (cpe:2.3:a:unknown:truebooker:*:*:*:*:*:*:*:*) indicates the plugin is widely identified as ‘TrueBooker’, though the vendor string is recorded as ‘unknown’.

RemediationAI

Upgrade to TrueBooker version 1.2.4 or later, as the vendor has released a patch addressing the missing ownership validation. Install the update from the WordPress plugin repository. If immediate patching is impossible, disable the TrueBooker plugin entirely to remove the vulnerable front-end handler-though this will eliminate all booking features. No other workaround is available. Reference: https://wpscan.com/vulnerability/c97d9841-2bd7-438b-a719-7943d671c754/.