CVE-2026-14364: TrueBooker WordPress Plugin Vulnerability
TL;DR - CVE-2026-14364 lets unauthenticated attackers reset arbitrary user passwords in TrueBooker through version 1.2.3. - WordPress sites using the plugin are affected; prioritize admin account review and plugin updates. - Severity is critical at 9.8, but public PoC and in-the-wild exploitation are not confirmed from available sources.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-14364 |
| CVSS | 9.8 / 10 (Critical) |
| Attack vector | Network |
| Privileges required | None |
| Patch available | Yes, evidence of a patch exists; exact first fixed version not conclusively confirmed from retrieved primary-source content |
CVE-2026-14364 affects the TrueBooker – Appointment Booking and Scheduler System plugin for WordPress. The issue is described by NVD as an account takeover vulnerability via improper password reset validation. In practical terms, the plugin can allow an unauthenticated attacker to reset another user’s password without properly proving identity first.
For defenders, the key point is that this is not a low-impact information leak or a narrowly scoped bug. The stated impact includes the ability to reset passwords for arbitrary accounts, including administrators. On a WordPress site, that can quickly turn into full administrative compromise, malicious plugin installation, content tampering, credential theft, or follow-on access to integrated systems.
What Is This Vulnerability?
The root cause is improper validation in the password reset workflow. According to the NVD description, the plugin does not properly validate a user’s identity before performing a password reset. That means the application logic appears to trust inputs or reset conditions that should have been bound to a verified user-controlled token, session, nonce, or equivalent proof of authorization.
In secure password reset design, the application should require strong evidence that the requester owns the target account, such as a time-limited reset token delivered out of band and verified server-side. If the application instead accepts insufficiently protected parameters, weakly validated requests, or reset actions not tied to the original request context, attackers can submit crafted requests to force password changes on behalf of other users.
For WordPress operators, this kind of flaw is particularly dangerous because the attack does not depend on phishing or user interaction. If exposed plugin functionality is reachable over the web and no authentication is needed, the attack path is short: identify a target username or email, trigger the vulnerable reset flow, set a new password, and log in as that user. If the target is an administrator, the site is effectively compromised.
Technical Notes
Because the patch diff was not retrievable in this research set, the exact vulnerable function or endpoint cannot be quoted directly. Defenders should therefore assume the weakness is in a plugin-exposed password reset handler and validate whether any custom AJAX, REST, or form-processing route in TrueBooker interacts with account reset logic.
A common pattern worth checking in plugin code review is server-side reset logic that accepts user identifiers without requiring a valid token:
// Illustrative anti-pattern only, not confirmed plugin code
if ( isset($_POST['user_id'], $_POST['new_password']) ) {
wp_set_password($_POST['new_password'], $_POST['user_id']);
}
If your team performs static review, search the plugin source for password reset functions and any missing capability, nonce, or token checks:
grep -RniE "wp_set_password|reset_password|retrieve_password|password" wp-content/plugins/truebooker-appointment-booking/
Who Is Affected?
The affected product is the TrueBooker – Appointment Booking and Scheduler System plugin for WordPress. Based on the available source material, all versions up to and including 1.2.3 are vulnerable. That version range is the strongest confirmed statement available from the NVD-backed description in the provided research.
The vendor/author attribution is best tied to the WordPress.org plugin listing under themetechmount, although separate branding associated with the product also appears publicly. For asset inventory and triage, what matters most is the plugin slug and installed version on WordPress sites, not the branding variation used on marketing pages.
If you run WordPress and have this plugin installed at 1.2.3 or earlier, you should consider the site exposed until proven otherwise. The exact first fixed version was not conclusively established from the fetched primary-source content, because the referenced WordPress Trac changeset could not be retrieved during this research session. A later public version may exist, but without direct confirmation of the first remediated release, defenders should upgrade to the latest available version immediately rather than aiming for a minimally fixed version.
Technical Notes
To identify affected installations on disk, check the plugin directory and version metadata:
grep -Rni "^Version:" /var/www/html/wp-content/plugins/truebooker-appointment-booking/
On hosts with WP-CLI available, inventory the installed plugin version directly:
wp plugin list --path=/var/www/html | grep truebooker
If you manage multiple WordPress sites centrally, scan for plugin directories matching the slug:
find /var/www -type d -path "*/wp-content/plugins/truebooker-appointment-booking"
CVSS Score Breakdown
The reported CVSS v3.1 base score is 9.8, which places this issue in the critical range. While the full vector string was not returned in the dataset provided, the score itself strongly suggests a combination of characteristics aligned with severe remote compromise: network-reachable attack surface, no privileges required, no user interaction, and high impact to confidentiality, integrity, and availability or at least to core administrative control.
That score makes sense given the described behavior. An unauthenticated password reset for arbitrary users is effectively a direct path to account takeover. If the attacker resets an administrator password, they can access the WordPress dashboard, modify site code, create new admin users, deploy backdoors, alter content, and potentially pivot to the underlying server depending on configuration and additional weaknesses.
In business terms, a 9.8 score here means this is not something to defer to a routine monthly patch cycle if the plugin is internet-facing. Even without confirmed active exploitation, the combination of unauthenticated access and admin takeover potential significantly raises the priority for patching and credential review.
Technical Notes
Because the exact NVD vector string was not available in the provided material, defenders should work from the described characteristics and assume a profile close to:
AV:N / AC:L / PR:N / UI:N / S:U / C:H / I:H / A:H
That vector is consistent with many remote unauthenticated takeover-class web flaws. If your internal risk model depends on exact vector values, document that the score is confirmed but the full vector was unavailable in this dataset.
Exploitation Status
Based on the provided research, active exploitation in the wild is not confirmed. The CVE is not listed in CISA’s Known Exploited Vulnerabilities catalog, and there is no CISA-backed evidence in this dataset showing confirmed exploitation activity. That is useful context, but it should not be mistaken for proof of safety.
Also based on the available sources, a public proof of concept is not confirmed. No direct GitHub exploit repository or validated public exploit reference was established from the source set provided. Likewise, the referenced Wordfence entry and WordPress changeset did not yield additional retrievable content in this session that would confirm exploit details or broad abuse.
Defenders should still assume exploitability is straightforward enough that opportunistic weaponization is plausible. Password reset vulnerabilities are often easier to operationalize than memory corruption or environment-specific bugs. If an exposed route can be found and the request parameters are predictable, attackers may not need a polished PoC release to begin exploitation.
Technical Notes
Current status based on available evidence:
- Public PoC: Not confirmed from available sources
- In-the-wild exploitation: Not confirmed from available sources
- CISA KEV: No
- Patch evidence: Yes, indicated by WordPress plugin repository changeset
3595807
In the absence of confirmed exploitation data, defenders should prioritize this issue based on exploitability and impact rather than waiting for KEV inclusion or vendor advisories with incident statistics.
How to Detect It
Detection should focus on three areas: unexpected password reset events, logins to privileged accounts from unusual IPs or user agents, and sudden administrative changes following a reset. Because the exact vulnerable endpoint was not included in the retrieved primary-source content, defenders need to inspect web, application, and WordPress audit logs broadly for password-reset-related requests associated with the TrueBooker plugin.
Start by reviewing web server access logs around suspicious authentication activity. If you see unauthenticated POST requests to plugin endpoints followed shortly by successful admin logins, treat that as high priority. Also review user account changes such as password resets, email changes, or new administrator creation. If your site uses a WordPress activity logging plugin, query for account management events affecting privileged users.
Where logs are limited, look for indirect indicators: administrator accounts logging in from new ASNs, plugin/theme installation shortly after a reset, changes to wp_users or wp_usermeta, and outbound requests consistent with malware staging or backdoor retrieval after initial access.
Technical Notes
Example access log patterns worth hunting for:
# Search for requests hitting the plugin path
grep -Ei "truebooker|appointment-booking" /var/log/nginx/access.log /var/log/apache2/*access*.log
# Search for password-reset-like parameters in POSTs if request logging includes query/body fragments
grep -Ei "reset|password|forgot|user_id|username|email" /var/log/nginx/access.log /var/log/apache2/*access*.log
Example suspicious sequence to investigate:
POST /wp-admin/admin-ajax.php?action=...truebooker...reset...
POST /wp-login.php
GET /wp-admin/
POST /wp-admin/user-new.php
POST /wp-admin/plugin-install.php
If you have WordPress audit logging into a SIEM, a generic hunt query could look like:
SELECT timestamp, username, ip, action, details
FROM wordpress_audit_logs
WHERE (
action ILIKE '%password reset%'
OR action ILIKE '%user updated%'
OR action ILIKE '%login success%'
)
AND timestamp >= NOW() - INTERVAL '30 days'
ORDER BY timestamp DESC;
For filesystem and database follow-up, check for recently modified admin users and unauthorized changes:
wp user list --role=administrator --path=/var/www/html
wp option get active_plugins --path=/var/www/html
find /var/www/html/wp-content -type f -mtime -7
Mitigation and Patching
The most important mitigation is to move off version 1.2.3 or earlier immediately. A WordPress plugin repository changeset referenced by NVD indicates that a patch exists, but the exact first fixed version could not be conclusively verified from the retrieved primary-source content. Because of that uncertainty, the safest recommendation is to upgrade to the latest available release from the official WordPress.org plugin listing or the vendor’s supported distribution channel.
If you cannot patch immediately, treat this as an exposure reduction exercise. Disable the plugin temporarily if business operations permit. If the plugin must remain online, restrict administrative access as much as possible, review all privileged accounts, reset administrator passwords, and ensure MFA is enforced where available. Also inspect for unauthorized admin accounts, modified email addresses, rogue scheduled tasks, and newly installed plugins or themes.
For incident response, if compromise is suspected, do not stop at patching. Reset credentials for all administrative users, rotate any secrets stored in WordPress or reused by administrators elsewhere, and review the full timeline of changes on the site. Attackers who obtained admin access may have planted persistent access through additional plugins, modified theme files, or database-backed options.
Technical Notes
Upgrade with WP-CLI:
# Update from the official source to the newest available release
wp plugin update truebooker-appointment-booking --path=/var/www/html
If you need to verify after upgrade:
wp plugin list --path=/var/www/html | grep truebooker
Temporary containment by deactivation:
wp plugin deactivate truebooker-appointment-booking --path=/var/www/html
If you suspect an administrator account was reset or abused, force password changes:
# Example: reset a specific admin password
wp user update admin --user_pass='Use-A-Strong-Unique-Temporary-Password' --path=/var/www/html
Additional immediate hardening steps:
# List administrator accounts for review
wp user list --role=administrator --fields=ID,user_login,user_email,registered --path=/var/www/html
# Review active plugins for unauthorized additions
wp plugin list --status=active --path=/var/www/html
If the exact fixed version remains unclear in your environment, document that uncertainty and keep the plugin at the latest available release until the vendor or WordPress repository metadata confirms the first remediated version.
References
The primary source for the vulnerability description is the NVD record for CVE-2026-14364, which states that the TrueBooker plugin is vulnerable to account takeover through improper password reset validation in all versions up to and including 1.2.3. That description is the basis for the root cause, affected versions, and impact statements in this article.
Additional supporting references include the WordPress plugin repository changeset 3595807, which indicates a code change associated with remediation, and the Wordfence vulnerability entry referenced by the CVE record. The WordPress.org plugin directory listing was also used to validate product naming and plugin identity. Because some referenced pages were not fully retrievable in the research session, specific patch-line details and the exact first fixed version remain unconfirmed here.
- NVD entry for CVE-2026-14364
- WordPress plugin Trac changeset:
https://plugins.trac.wordpress.org/changeset/3595807/truebooker-appointment-booking - Wordfence vulnerability reference:
https://www.wordfence.com/threat-intel/vulnerabilities/id/f441477e-35b8-42ae-b71c-3fdba126021b?source=cve - WordPress.org plugin page:
https://wordpress.org/plugins/truebooker-appointment-booking - Product site identified during verification:
https://truebookerplugin.com
If you run this plugin, the prudent assumption is simple: 1.2.3 and earlier are vulnerable, exploitability is serious, and upgrading plus account review should happen immediately even without confirmed in-the-wild exploitation.
For further reading on related vulnerabilities, check out our articles on CVE-2026-12806 and What is Social Engineering?.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.