CVE-2026-14364
CriticalCVSS 9.8Summary
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress, in all versions up to and including 1.2.3, is vulnerable to account takeover via improper password reset validation. The plugin does not properly validate a user's identity before resetting their password, allowing unauthenticated attackers to reset passwords of arbitrary user accounts, including administrators.
Risk Assessment
An attacker can take over administrator accounts, leading to full compromise of the WordPress site.
Recommendation
Update the TrueBooker plugin to the latest available version that includes the security fix.
Original NVD description (English source)
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity before resetting their password. This makes it possible for unauthenticated attackers to reset the password of arbitrary user accounts, including administrators, and gain access to those accounts.