CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-14364 — The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress i...

·Source: NIST NVD

Updated:

Executive Summary

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity before resetting their password. This makes it possible for unauthenticated attackers to reset the password of arbitrary user accounts,

Analysis

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity before resetting their password. This makes it possible for unauthenticated attackers to reset the password of arbitrary user accounts, including administrators, and gain access to those accounts. CVSS Score: 9.8. Published: 2026-08-07T05:16:57.743.

Indicators of Compromise (1)

CVE (1)
CVE-2026-14364
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 7, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Linux Shell Forensic: Let?s Dive Into Atuin!, (Fri, Aug 7th)

UNIX systems (including Linux) are well-known to record a lot of activities in many different locations. But there is one domain where they definitely lack of "modern" logging: shells. Most shells provide an historization of the typed commands through a flat file in the $HOME directory (ex: $HOME/.bash_history). They suffer of multiple problems:

SANS ISC
CRITICALVulnerability

Critical Vulnerabilities Patched With Chrome 151 Update

The browser refresh eliminates over two dozen memory safety bugs, including critical use-after-free flaws. The post Critical Vulnerabilities Patched With Chrome 151 Update appeared first on SecurityWeek .

SecurityWeek
CRITICALVulnerability

NVD CRITICAL: CVE-2026-14365 — The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress i...

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to change the password of arbitrary user accounts, including administrators, which can b

CVE-2026-14365
NIST NVD