CVE-2026-14545 — TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauth…
Published: 2026-07-28 · CVSS: 9.8 · CVSS 3.1
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7