CVE-2026-14364— TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'
Quick assessment
Affected
themetechmount TrueBooker – Appointment Booking and Scheduler System
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 TrueBooker – 预约预订与调度系统插件存在账户接管漏洞，影响版本为 1.2.3 及以下的所有版本。该漏洞源于插件在重置密码前未正确验证用户身份。这使得未经身份验证的攻击者能够任意重置用户账户（包括管理员账户）的密码，从而获取对这些账户的访问权限。
Possible ATT&CK Techniques 1 AI
T1098 · Account ManipulationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| themetechmount | TrueBooker – Appointment Booking and Scheduler System | ≤ 1.2.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-14364
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'
Source: CVE Program / CVE List V5
Vulnerability Description
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity before resetting their password. This makes it possible for unauthenticated attackers to reset the password of arbitrary user accounts, including administrators, and gain access to those accounts.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
忘记口令恢复机制弱
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| themetechmount | TrueBooker – Appointment Booking and Scheduler System | 0 ~ 1.2.3 | - |
|
II. Public POCs for CVE-2026-14364
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14364
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-14364 (1)
Security Blog Posts for CVE-2026-14364 (1)
IV. Related Vulnerabilities
Same product: TrueBooker – Appointment Booking and Scheduler System
-
CVE-2026-14349
TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticat -
CVE-2026-18315
TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass T -
CVE-2026-16142
TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via I -
CVE-2026-14365
TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticat -
CVE-2026-13161
TrueBooker <= 1.2.2 - Unauthenticated SQL Injection
Same vendor: themetechmount
-
CVE-2026-39798
WordPress TrueBooker plugin <= 1.2.9 - Settings Change vulne -
CVE-2026-14349
TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticat -
CVE-2026-18315
TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass T -
CVE-2026-73347
WordPress TrueBooker plugin <= 1.2.6 - Privilege Escalation -
CVE-2026-16142
TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via I
Same weakness: CWE-640
-
CVE-2026-102115
Kiteworks Core Authentication Bypass in the Password Reset W -
CVE-2026-101188
Netcore POWER13 ubus routerd.passwd_set password recovery -
CVE-2026-100870
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 A -
CVE-2026-93340
Gladys Assistant < 5.1.0 Password Reset Link Poisoning via f -
CVE-2026-93453
SOGo before 5.12.11 Password Reset Token Interception via Or
V. Comments for CVE-2026-14364
No comments yet