Skip to content
eastbaycyber

CVE-2026-14365: Unauthenticated Password Change in TrueBooker Plugin

CVE explainers 10 min read
SR
Security Research Desk Expert reviewed
Threat intelligence · Human-verified · Updated 2026-08-07
▲ Escalation ViewOne CVE, briefed at three altitudes — skim the Brief, weigh the Impact, or work the Runbook. The way a SOC actually reads it.
CISOBrief · 30-second brief

TL;DR - Critical flaw in TrueBooker for WordPress allows unauthenticated password changes. - Affects versions up to and including 1.2.3; update immediately. - Risk is high because admin account takeover can lead to full site compromise.

Vulnerability at a Glance

Field Value
CVE ID CVE-2026-14365
CVSS score 9.8 (Critical)
Attack vector Network / remote over HTTP
Auth required No
Patch available Yes, newer versions exist; update beyond 1.2.3

CVE-2026-14365 affects the TrueBooker – Appointment Booking and Scheduler System plugin for WordPress. According to NVD, the issue is an authorization bypass that allows an unauthenticated attacker to change the password of arbitrary user accounts, including administrators. That turns what might look like a simple access control bug into a direct path to account takeover.

The most important operational detail is the affected version range: all versions up to and including 1.2.3 are vulnerable. Public plugin metadata shows a newer version, 1.2.6, is available on WordPress.org. While the source material here does not include a directly retrievable vendor advisory stating the exact fixed version, defenders should treat 1.2.6 as the safe upgrade target because it is the current publicly listed release and is newer than the vulnerable range.

What Is This Vulnerability?

At its core, this is a missing or improper authorization check in a password-change path exposed by the plugin. NVD states the plugin “does not properly verify that a user is authorized to perform an action,” making it possible for an unauthenticated attacker to change passwords for arbitrary accounts. In practical terms, the vulnerable code path appears to accept a password update request without enforcing that the caller is logged in and allowed to modify the target account.

That matters because authorization failures in account-management functions are especially dangerous in WordPress environments. If an attacker can reset the password for an administrator account, they do not need a separate remote code execution bug to gain meaningful control. Administrator access is often enough to log in to /wp-admin/, install a malicious plugin, edit site content, create persistence through new users, or alter themes and settings. For many organizations, that is equivalent to full application compromise.

The root cause category is best described as authorization bypass rather than authentication bypass in the narrow sense. The application already has a function that performs a privileged action, but it fails to check whether the caller should be allowed to use it. The distinction matters for defenders because the exploit traffic may not look like a classic login bypass; it may instead appear as a normal application request to a plugin endpoint or AJAX action.

Technical Notes

Because the patch diff was not directly retrievable from the referenced WordPress changeset during source collection, defenders should assume the vulnerable behavior lives in a plugin-exposed action handler, form handler, or AJAX endpoint tied to account updates. In WordPress plugins, this often shows up as insufficient validation around requests made to admin-ajax.php, custom REST routes, or plugin-specific POST handlers.

A representative secure pattern in WordPress would include checks like these before allowing a password update:

if ( ! is_user_logged_in() ) {
    wp_die('Unauthorized', 401);
}

if ( ! current_user_can('edit_user', $target_user_id) ) {
    wp_die('Forbidden', 403);
}

check_admin_referer('truebooker_password_change');

If those checks are missing or improperly scoped, an unauthenticated request may be able to reach the password-change logic.

AnalystImpact · assess the risk

Who Is Affected?

The affected product is TrueBooker – Appointment Booking and Scheduler System for WordPress, published on WordPress.org by ThemetechMount. The vulnerable range, per NVD, is all versions up to and including 1.2.3. That means any WordPress site running TrueBooker 1.2.3 or earlier should be considered exposed until the plugin is upgraded or disabled.

From the data available here, the plugin page on WordPress.org shows 1.2.6 as the current listed version. Because the fix advisory text was not directly accessible in the source set, the most defensible statement is: versions <= 1.2.3 are vulnerable; defenders should upgrade to the latest available version, currently 1.2.6, or at minimum to any version newer than 1.2.3. If change control requires exact fixed-version confirmation, teams should still treat this as an emergency patch and validate with the vendor or WordPress changelog out of band.

This issue primarily affects site owners, MSPs, shared hosting customers, SMBs, and agencies that rely on WordPress plugins for booking workflows. Internet-exposed WordPress instances are the most obvious risk, but even sites protected behind basic WAF rules may still be vulnerable if the plugin endpoint remains reachable and the request pattern is not blocked. If the site has privileged WordPress accounts with weak operational controls, the downstream impact grows significantly.

Technical Notes

You can quickly inventory affected plugin versions from the filesystem or WP-CLI.

wp plugin list --path=/var/www/html | grep truebooker

A manual check on disk may also help:

grep -R "Version:" /var/www/html/wp-content/plugins/truebooker-appointment-booking/*

If the plugin version is 1.2.3 or below, assume the instance is vulnerable unless you have separate evidence of a backported fix.

CVSS Score Breakdown

NVD assigns CVSS 9.8 (Critical). The exact vector string was not included in the source material provided here, but a 9.8 score strongly implies the common high-risk pattern of network exploitable, low attack complexity, no privileges required, and high impact. That matches the described behavior: an attacker can remotely change arbitrary user passwords without authentication.

From an operational perspective, the score makes sense because the vulnerability creates a straightforward path from internet access to account takeover. On WordPress, taking over an administrator account often leads to complete control of the application plane. Even where direct server-level compromise does not follow automatically, application-level admin rights are enough to alter business content, inject spam or malware, steal data accessible through WordPress, and disrupt availability.

Confidentiality impact is likely high because an attacker controlling an admin account can access user and booking data through the application. Integrity impact is clearly high because passwords, content, settings, and plugin state can be changed. Availability impact can also be high if an attacker locks out admins, defaces the site, or installs destructive code.

Technical Notes

In the absence of the exact published vector string from the retrieved NVD output, defenders should assume a risk profile broadly equivalent to:

AV:N / AC:L / PR:N / UI:N / S:U / C:H / I:H / A:H

That is not a quoted official vector here, but it reflects the practical meaning of a 9.8-rated unauthenticated account takeover flaw.

Exploitation Status

Based on the sources provided, active exploitation in the wild is not confirmed at this time. The CVE is not listed in CISA’s Known Exploited Vulnerabilities catalog, which means there is no CISA-backed confirmation of exploitation, no KEV due date, and no federal remediation directive tied to this issue.

Also based on the source set used here, a public proof of concept was not confirmed. That is important, but it should not reduce urgency. Vulnerabilities involving unauthenticated password changes are often easy for attackers to reverse-engineer from a patch diff, plugin update, or even black-box probing of plugin endpoints. In other words, the absence of a confirmed PoC in the source material does not mean exploitation is unlikely.

For defenders, the right conclusion is: no confirmed in-the-wild exploitation from the cited sources, no confirmed public PoC from the cited sources, but exploitability should be assumed to be practical because the flaw is remote, unauthenticated, and directly actionable.

Technical Notes

Treat the plugin as high-priority for threat hunting even without public exploit code. Watch for this sequence:

  1. POST request to a plugin-related endpoint or WordPress AJAX handler.
  2. Immediate login success for an admin or editor account from a new IP or user agent.
  3. Subsequent administrative actions such as plugin installation, user creation, or theme edits.
ResponderRunbook · act now

How to Detect It

Detection should focus on unexpected password changes, suspicious HTTP requests to plugin handlers, and follow-on admin behavior. Because the exact vulnerable route is not confirmed in the sources available here, the best practical approach is to correlate WordPress login events, password reset/change events where logged, and web requests touching TrueBooker or password update functionality. If you operate centralized logging for Apache, Nginx, WordPress activity logs, or a WAF, build detection around those signals immediately.

Start by identifying any admin account that suddenly logs in after a password change not initiated by your team. Then review web server access logs for POST requests to endpoints associated with the plugin, WordPress AJAX, or account-management actions during the same time window. Even if the exact parameter names differ, suspicious patterns usually include POSTs that reference a target user ID, username, email, or new password field, followed by a login from a previously unseen source.

If you do not have detailed WordPress audit logging enabled, assume detection coverage is incomplete. In that case, the safer operational move is to patch first, then review for indicators of admin account takeover and persistence such as rogue users, newly installed plugins, modified theme files, and changes to options.

Technical Notes

Example web log hunting patterns:

grep -Ei 'POST .*wp-admin/admin-ajax\.php|POST .*truebooker|POST .*password|POST .*reset' /var/log/nginx/access.log

Example suspicious Nginx log pattern to review manually:

POST /wp-admin/admin-ajax.php HTTP/1.1
POST /wp-content/plugins/truebooker-appointment-booking/...

Example Splunk search for suspicious password-change and follow-on login activity:

index=web (uri_path="/wp-admin/admin-ajax.php" OR uri_path="*/truebooker*")
method=POST
| stats count values(uri_path) values(src_ip) values(user_agent) by _time, host

Example broader correlation for WordPress environments:

(index=web method=POST ("truebooker" OR "admin-ajax.php" OR "password"))
OR
(index=auth ("wp-login.php" OR "WordPress login"))
| transaction host maxspan=30m
| search eventcount>1

Also inspect for follow-on persistence:

wp user list --role=administrator
wp plugin list
find /var/www/html/wp-content -type f -mtime -7

Mitigation and Patching

The primary mitigation is to upgrade the TrueBooker plugin immediately. The vulnerable range is all versions up to and including 1.2.3. The current public version observed on WordPress.org is 1.2.6, so the safest guidance from the available evidence is to upgrade to 1.2.6. If your repository or managed hosting platform offers a different newer version, use the latest vendor-published release.

If you cannot patch immediately, the next-best workaround is to disable the plugin until you can update. Because the flaw enables unauthenticated password changes, leaving the plugin active on an internet-facing site creates a serious account takeover risk. If exposure is suspected, do not stop at patching: reset passwords for privileged users, review admin account history, revoke unknown sessions, inspect installed plugins/themes, and check for unauthorized new users or content changes.

Where exact fix details are unavailable, defenders should assume that any version in the vulnerable range is unsafe and that edge filtering may only be partially effective. A WAF rule can help reduce opportunistic exploitation if you can identify the plugin endpoint, but it should be treated as temporary risk reduction, not a substitute for upgrade or removal.

Technical Notes

Upgrade with WP-CLI:

wp plugin update truebooker-appointment-booking --path=/var/www/html

If you need to pin to the latest available release visible on WordPress.org through your normal update channel, confirm afterward:

wp plugin list --path=/var/www/html | grep truebooker

If immediate upgrade is not possible, deactivate the plugin:

wp plugin deactivate truebooker-appointment-booking --path=/var/www/html

As a manual containment step, you can also temporarily block direct access patterns associated with the plugin at the web tier while testing, though this may not cover all exploit paths:

location ~* /wp-content/plugins/truebooker-appointment-booking/ {
    deny all;
    return 403;
}

After remediation, rotate credentials for privileged accounts and invalidate sessions where feasible.

wp user session destroy --all --path=/var/www/html

References

The primary source for the vulnerability description and affected version range is the NVD record for CVE-2026-14365. It explicitly states that the TrueBooker – Appointment Booking and Scheduler System plugin is vulnerable to authorization bypass in all versions up to and including 1.2.3, allowing unauthenticated attackers to change arbitrary user passwords, including administrator accounts.

The WordPress.org plugin listing is the key source used here to verify the plugin name, publisher identity, and currently listed version. The NVD record also references a WordPress plugin changeset and a Wordfence entry, but the changeset content was not directly retrievable in the source collection used for this article. As a result, exact code-level patch details are not quoted here, and defenders should rely on the vulnerable-version statement from NVD plus immediate upgrade to the latest available release.

If you are responding to a potentially exposed site, prioritize these steps in order: update or disable the plugin, review admin account password changes, inspect for rogue administrator users, and audit for post-compromise changes to plugins, themes, and WordPress settings.

Last verified: 2026-08-07

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.