CVE-2026-14545
A flaw in the TrueBooker WordPress plugin lets anyone on the internet reset any user’s password without authentication. By using the front‑end password‑reset feature, an attacker can take over administrator accounts and control the entire site. The issue exists in all versions before 1.2.4.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
TrueBooker WordPress plugin, versions earlier than 1.2.4, used on WordPress sites.
Real-world impact
An attacker can set a new password for any account, including administrators, and gain full control of the WordPress site, enabling data theft, defacement, or further exploitation.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network, requires no authentication, and gives the attacker complete compromise of confidentiality, integrity, and availability.
What to do about it
- 01Upgrade the TrueBooker plugin to version 1.2.4 or later.
NVD-referenced vendor advisory
Timeline
- Jul 28, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 28, 2026 · 2d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.