CVE-2026-14545 in TrueBooker Plugin
Summary
by MITRE • 07/28/2026
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/28/2026
The TrueBooker WordPress plugin vulnerability represents a critical authentication bypass issue that fundamentally undermines the security model of WordPress sites using this plugin. This flaw exists in versions prior to 1.2.4 and stems from inadequate validation mechanisms within the plugin's front-end account handling system. The vulnerability allows unauthenticated attackers to exploit the password reset functionality without proper authorization, creating a pathway for complete site compromise through arbitrary account takeover. The technical implementation fails to verify that the user requesting a password reset actually owns the account they are targeting, effectively removing any barrier between malicious actors and administrative control of the WordPress installation.
This vulnerability directly maps to CWE-862, which describes insufficient authorization checks in software systems, and aligns with ATT&CK technique T1566.002 related to credential access through social engineering. The flaw operates at the application layer where the plugin's password reset handler does not perform proper authentication validation before executing account modifications. Attackers can simply submit a password reset request targeting any user account, including administrators, without providing valid credentials or proof of ownership. This represents a severe violation of the principle of least privilege and demonstrates a fundamental failure in implementing proper access controls within the plugin's user management functions.
The operational impact of this vulnerability is devastating for affected WordPress installations as it enables complete takeover of administrative accounts with minimal technical skill required from attackers. Once an attacker successfully exploits this vulnerability, they gain full administrative privileges over the WordPress site, allowing them to modify content, install malicious plugins, steal sensitive data, and potentially use the compromised site as a launching point for further attacks against other systems in the network. The ease of exploitation means that automated attack tools could rapidly scan for vulnerable sites and compromise them without requiring any specific knowledge of valid credentials or user accounts. This makes the vulnerability particularly dangerous in large-scale attacks where attackers can target multiple sites simultaneously.
Mitigation strategies should focus on immediate plugin updates to version 1.2.4 or later, which presumably contain the necessary authentication validation fixes. System administrators should also implement additional security measures including monitoring for unusual password reset activities, enforcing strong password policies, and considering the implementation of two-factor authentication for administrative accounts. Network-level protections such as rate limiting on password reset requests and IP address monitoring can help detect potential exploitation attempts. Organizations should conduct comprehensive security assessments to identify other potentially vulnerable plugins and ensure that all WordPress components are kept up to date with the latest security patches. The vulnerability highlights the critical importance of proper input validation and authentication mechanisms in web applications, particularly in user management functions where the stakes for security breaches are highest.