Skip to main content

Truebooker Appointment Booking And Scheduler System EUVDEUVD-2026-80094

| CVE-2026-14349 CRITICAL
Missing Authorization (CWE-862)
2026-09-16 Wordfence GHSA-q48r-xvfr-f623
WordPress Authentication Bypass Truebooker Appointment Booking And Scheduler System Wordpress Plugin Themetechmount
9.8
CVSS 3.1 · NVD
Share

Severity by source

Vendor (Wordfence) PRIMARY
CRITICAL
qualitative
NVD
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Wordfence).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Sep 16, 2026 - 04:00 vuln.today
CVE Published
Sep 16, 2026 - 03:28 cve.org
CRITICAL 9.8

DescriptionNVD

The TrueBooker - Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the email address of arbitrary user accounts, including administrators, which can be leveraged to reset the account's password and gain access to it.

Articles & Coverage 1

News We need answer user. Need generate concise SEO-friendly article title. Need follow format. We have CVE, Product, Severity, Summary blank? They gave: CVE: CVE-2026-14349 Product: WordPress Severity: CRITICAL Summary: Need generate title. Need "Critical/High [Vulnerability Type] in [Product] - [CVE-ID]" Max 100 chars. Return ONLY title no quotes. But vulnerability type unknown because summary blank. Need infer? We need maybe choose generic? The instruction says Summary: blank. We Sep 16, 2026

Analysis

The TrueBooker - Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Truebooker Appointment Booking And Scheduler System

View all
CVE-2026-18315 CRITICAL
9.8 Aug 19

Account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1
CVE-2026-14365 CRITICAL
9.8 Aug 07

Unauthenticated account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all ve
CVE-2026-14364 CRITICAL
9.8 Aug 07

Account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1
CVE-2026-1797 MEDIUM
5.3 Mar 31

Unauthenticated attackers can directly access view PHP files in the Truebooker WordPress plugin (versions up to 1.1.4) t

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-80094 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy