CVE-2026-14365: TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id'
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to change the password of arbitrary user accounts, including administrators, which can be leveraged to gain access to those accounts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/TrueBooker – Appointment Booking and Scheduler System pluginto a version that resolves this vulnerability.Fixed in 1.2.3 - Compensating control
Restrict access so unauthenticated users cannot reach the endpoint that uses the 'truebooker_wp_user_id' parameter to attempt arbitrary password reset.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14365?
CVE-2026-14365 has a critical severity rating of 9.8.
What is CVE-2026-14365 about?
CVE-2026-14365 describes an authorization bypass vulnerability in the TrueBooker plugin for WordPress allowing unauthenticated users to reset passwords.
How do I fix CVE-2026-14365?
To fix CVE-2026-14365, update the TrueBooker plugin to version 1.2.4 or later.
Who is affected by CVE-2026-14365?
All users of the TrueBooker plugin for WordPress versions 1.2.3 and earlier are affected by CVE-2026-14365.
What types of attacks are possible with CVE-2026-14365?
CVE-2026-14365 allows attackers to execute unauthenticated arbitrary password resets, leading to account takeovers.