CVE-2026-14545

TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset

Critical · published July 28, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
41.8
In the wild
Unconfirmed
What it is

The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00498 · 41.8th percentile
Published
2026-07-28T06:00Z
EPSS history
Timeline
  • 28 JUL 06:00Z
    TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset
    cvelistv5