CVE-2026-14545
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The TrueBooker WordPress plugin before version 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers. This allows unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.
Risk Assessment
The organization risks complete site takeover by an unauthenticated attacker who can set a custom password on the admin account.
Recommendation
Immediately update the TrueBooker plugin to version 1.2.4 or later.
Original NVD description (English source)
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.