TrueBooker Plugin: Critical Flaw Enables Admin Takeover (CVE-2026-14545)

Published on 7 August 2026

An attacker needs no username, no password and no special skills – just a handful of publicly available pieces of information from your website. With those, they can reset the password of your administrator account and take complete control of your WordPress site. This is exactly what the critical vulnerability CVE-2026-14545 in the widely used booking plugin TrueBooker makes possible. The security flaw has been rated at the highest practical severity level: CVSS 9.8 out of 10 – meaning "critical". If you use this plugin, you should keep reading now and act immediately.

What happened?

The WordPress plugin TrueBooker – Appointment Booking and Scheduler System allows website operators to offer appointment bookings directly through their own website – popular with medical practices, hairdressers, consultants or trade businesses, for example. In all versions before 1.2.4, this plugin contains a serious flaw in the function that lets users reset their passwords.

Specifically, when handling a password reset request, the plugin does not check whether the requesting person is actually the owner of the affected account. In other words: anyone – including a complete stranger who is not logged in (in technical terms: an "unauthenticated" attacker) from the internet – can set a new password for any account. This explicitly includes the administrator account used to manage the entire website.

The responsible US authority NVD (National Vulnerability Database, an official database for security vulnerabilities) describes the problem as follows:

"The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers…"
(In essence: The TrueBooker plugin before version 1.2.4 does not check, in one of its front-end password reset handlers, whether the account belongs to the requester.)
— NVD, nvd.nist.gov

The technical background – explained clearly

Technically, the flaw falls under the category CWE-269 (Improper Privilege Management), i.e. a faulty management of permissions. The sequence of an attack is alarmingly simple:

1. The attacker reads two public nonces from the website. A "nonce" is actually a security token (a kind of one-time numeric code) intended to protect requests – but here these values are freely visible.
2. The attacker then sends a manipulated POST request (a common way of sending data to a server) to the endpoint user_front_resetpass.
3. In this request they specify an arbitrary user ID – for example "1", which by default belongs to the administrator in WordPress – along with a new, self-chosen password.
4. Because the plugin does not check the so-called user_activation_key (the key that should confirm a legitimate reset request) for accounts in their default state, the password is changed without any further verification.

The result: the attacker logs in as administrator using the password they set – and has free rein. No user interaction is required, no click by the victim, no prior knowledge. The attack can be carried out remotely and can be automated with ease.

Who is affected?

All websites using the plugin TrueBooker in a version ≤ 1.2.4 are affected. According to available figures, the plugin is actively in use on more than 600 websites. While this distribution is manageable compared to major plugins, the risk is existential for every single affected operator, because a successful exploit means the complete loss of control over one's own website.

Important for putting the timeline in context: at the time this vulnerability was published (3 August 2026), no active exploit in the wild was known. That, however, is no reason to sound the all-clear. The security provider Patchstack warns explicitly:

"This vulnerability is highly dangerous and expected to become exploited. Vulnerabilities like this one are used in mass-exploit campaigns."
(In essence: This vulnerability is highly dangerous, and it is to be expected that it will be exploited. Flaws like this one are used in mass attack campaigns.)
— Patchstack

The Ionix Research Team also gets to the heart of the danger:

"The vulnerability allows an unauthenticated remote attacker to reset the password of any WordPress account — including site administrators — by exploiting a front-end account handler that performs no account ownership validation…"
(In essence: The vulnerability allows an unauthenticated, remote attacker to reset the password of any WordPress account – including administrators – by exploiting a front-end handler that performs no ownership validation of the account.)
— Ionix

Timeline

• 7 July 2026: Original disclosure of the vulnerability by security researcher Pedro Pinho on the WPScan platform.
• 28 July 2026: Official assignment and publication of the entry CVE-2026-14545 in the National Vulnerability Database (NVD).
• 30 July 2026: Publication of mitigation rules (i.e. protective measures to defend against attacks) by security providers such as Patchstack.

How to check whether you are affected

Work through the following steps in your WordPress dashboard:

1. Check the plugin: In the WordPress dashboard, open the "Plugins" menu item and check whether the plugin "TrueBooker" is installed.
2. Check the version: Look at the version number. If it is lower than 1.2.4, you are affected and must act immediately.
3. Review the user list: Open "Users" → "All Users" and check whether any unknown administrator accounts have appeared there. These would be a clear sign of an attack that has already taken place.
4. Check the server logs: Examine your server logs for unusual POST requests to /wp-admin/admin-ajax.php with the action user_front_resetpass. If you can't get any further here, bring in your hosting provider or a specialist service provider.

What you need to do now

Act quickly – the plugin's low distribution is not a security guarantee but rather a reason why less attention is directed at fast updates. The good news: a patch already exists. Version 1.2.4 fixes the problem, and version 1.2.6 is already available.

1. Update the plugin: Bring TrueBooker up to the latest version immediately (at least 1.2.4, recommended 1.2.6). This is the most important and most effective measure.
2. Deactivate if necessary: If an update is not immediately possible, temporarily deactivate the plugin until you can update. A briefly missing booking function is far less painful than a hijacked website.
3. Reset administrator passwords: As a precaution, set new passwords for all administrator accounts. This locks out accounts that may already have been compromised.
4. Set up a Web Application Firewall (WAF): A WAF is a protective shield that detects and blocks malicious requests before they reach your website. It provides additional protection – including against future vulnerabilities.

Context: Why this is so serious

This vulnerability is exemplary of a larger pattern in the WordPress environment. The numbers are unambiguous:

• In 2025, 11,334 new vulnerabilities were found in the WordPress ecosystem – an increase of 42% over the previous year.
• 91% of all new WordPress vulnerabilities affect plugins – not the WordPress core itself.
• The median time until the first mass exploitation of a critical vulnerability is only five hours.
• 46% of reported vulnerabilities have no patch available at the time they are published.

The five hours until mass exploitation in particular make one thing clear: once a critical flaw becomes public, every hour counts. Fortunately, a patch already exists for the TrueBooker flaw – take advantage of it.

GDPR relevance: The legal risk

A successful exploit of CVE-2026-14545 is not just a technical problem but a legal one too. If an attacker takes control of your website, they potentially gain access to all personal data stored in the system – in the case of a booking system, that means customer data, booking information and email addresses in particular.

This constitutes a data breach within the meaning of the GDPR (Art. 33). In concrete terms, this means:

• You are obliged to report the incident to the competent data protection supervisory authority within 72 hours of becoming aware of it.
• Failure to meet this reporting obligation risks substantial fines.

This makes it clear: an incident that is initially purely technical can quickly bring considerable economic and legal consequences – from reputational damage all the way to fines.

Conclusion

CVE-2026-14545 is one of the most dangerous types of vulnerability there is: unauthenticated, remotely exploitable, requiring no user interaction and resulting in complete takeover of control. The CVSS score of 9.8 is no exaggeration. Even though no active attack is known at the current time, several security providers warn unambiguously that mass attack campaigns are to be expected.

The course of action is accordingly simple and urgent: if you use TrueBooker, update the plugin immediately to at least version 1.2.4 (recommended 1.2.6). If that is not immediately possible, temporarily deactivate it, reset your administrator passwords and check your user list for unknown accounts. Anyone who consistently carries out these few steps closes a critical door before an attacker can use it.

Are you unsure whether your website is affected or whether an attack has already taken place? Don't hesitate to bring in professional support – especially when reviewing server logs and securing your site after a possible incident.

Sources

• TechJack Solutions – Primary source
• NVD – CVE-2026-14545
• WPScan – Vulnerability entry
• Ionix – Threat Center
• Patchstack – Database entry
• FreshySites – Security Bulletin
• Hide My WP Ghost / Swif.ai – Statistics
• GDPR law – Art. 33 GDPR