CVE-2026-14364: TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity before resetting their password. This makes it possible for unauthenticated attackers to reset the password of arbitrary user accounts, including administrators, and gain access to those accounts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: TrueBooker – Appointment Booking and Scheduler Systemto a version that resolves this vulnerability.Fixed in 1.2.3 - Compensating control
Restrict access to any publicly reachable password reset endpoint/route in the WordPress site that could accept the TrueBooker password reset parameter 'tbab-userid' until the plugin is updated (e.g., allow only authenticated/admin sources or block unauthenticated requests to that endpoint at the network layer/WAF).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14364?
CVE-2026-14364 has a critical severity rating of 9.8.
How do I fix CVE-2026-14364?
To fix CVE-2026-14364, update the TrueBooker plugin to version 1.2.4 or later.
What type of vulnerability is CVE-2026-14364?
CVE-2026-14364 is an account takeover vulnerability due to missing authorization for password resets.
Who is affected by CVE-2026-14364?
All installations of the TrueBooker plugin for WordPress version 1.2.3 and earlier are affected by CVE-2026-14364.
What can attackers do with CVE-2026-14364?
Attackers can exploit CVE-2026-14364 to reset passwords and potentially take over user accounts without proper validation.