TrueBooker <=1.2.3 Unauthenticated Arbitrary Password Reset via Missing Authorization (CVE-2026-14364)

Vulnerability Overview Vulnerability Name: TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'bab-userid' CVE ID: CVE-2026-14364 CVSS Score: 9.8 (Critical) Release Date: August 6, 2026 Last Updated: August 7, 2026 Researcher: thesietron - GalaxyOne Affected Products Software Type: Plugin Software Name: TrueBooker – Appointment Booking and Scheduler System Affected Versions: <= 1.2.3 Fixed Version: 1.2.4 Remediation Fix: Upgrade to version 1.2.4 or later. Vulnerability Description The TrueBooker – Appointment Booking and Scheduler System plugin, in versions 1.2.3 and earlier, contains a vulnerability that allows attackers to take over accounts through flawed password reset verification. This vulnerability arises because the plugin fails to properly validate user identity, allowing unauthorized attackers to reset the passwords of arbitrary user accounts (including administrators) and gain access to those accounts. References plugins.trac.wordpress.org Additional Information Webhook Integration: Wordfence Intelligence offers free personal and commercial API access, as well as free webhook integration, to keep you informed of the latest vulnerabilities. Support: Customer support is available from 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT, excluding weekends and holidays. Response time is within 1 hour. Related Vulnerabilities CVE-2026-13161: TrueBooker <= 1.2.2 - Unauthenticated SQL Injection CVE-2026-61951: TrueBooker – Appointment Booking and Scheduler System <= 1.2.3 - Unauthenticated Privilege Escalation CVE-2026-61950: TrueBooker – Appointment Booking and Scheduler System <= 1.2.3 - Unauthenticated SQL Injection CVE-2026-48881: TrueBooker – Appointment Booking and Scheduler System <= 1.1.9 - Missing Authorization CVE-2026-1797: TrueBooker – Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files CVE-2026-39663: TrueBooker <= 1.1.6 - Missing Authorization CVE-2025-67581: TrueBooker <= 1.1.0 - Missing Authorization CVE-2025-47543: TrueBooker <= 1.0.7 - Cross-Site Request Forgery CVE-2024-6925: TrueBooker <= 1.0.2 - Cross-Site Request Forgery to Settings Update Disclaimer This record contains copyrighted material. License: Defiant Inc. grants a permanent, worldwide, non-exclusive, non-transferable, royalty-free, irrevocable copyright license to copy, prepare derivative works, publicly display, publicly perform, distribute, and disseminate software vulnerability information. MITRE Corporation grants a permanent, worldwide, non-exclusive, non-transferable, royalty-free, irrevocable copyright license to copy, prepare derivative works, publicly display, publicly perform, distribute, and disseminate Common Vulnerabilities and Exposures (CVE) information. Contact For any questions or to request more information, please contact: info-support@wordfence.com Additional Resources Learn More: Learn More Get Wordfence: Get Wordfence Documentation: Documentation Footer Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Facebook: Facebook Twitter: Twitter LinkedIn: LinkedIn Email: Email Copyright Information © 2012-2026 Defiant Inc. All Rights Reserved Additional Links Products: Products Support: Support News: News About: About Stay Updated: Stay Updated Sign Up Sign Up: Sign Up

Goal Reached Thanks to every supporter — we hit 100%!

TrueBooker <=1.2.3 Unauthenticated Arbitrary Password Reset via Missing Authorization (CVE-2026-14364)