Password Reset Vulnerability in TrueBooker WordPress Plugin
CVE-2026-14545
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 28 July 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-14545?
The TrueBooker WordPress plugin is susceptible to a vulnerability that allows unauthenticated attackers to reset passwords for any user account. This flaw exists because the plugin fails to properly validate account ownership during the password reset process. As a result, attackers can exploit this issue to set arbitrary passwords on user accounts, including those of administrators, effectively gaining full control over the site. It is crucial for users to update to version 1.2.4 or later to mitigate this risk.
Affected Version(s)
TrueBooker 0 < 1.2.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.