A missing authorization check in the TrueBooker – Appointment Booking and Scheduler System plugin for WordPress lets unauthenticated attackers change any user's email address, including an administrator's, and then seize the account via password reset.
What Is It
CVE-2026-14349 is an authorization bypass (CWE-862, Missing Authorization) in the TrueBooker – Appointment Booking and Scheduler System plugin for WordPress, published by vendor themetechmount. The plugin fails to properly verify that a requesting user is authorized to perform an action. As a result, an unauthenticated attacker can modify the email address on arbitrary user accounts. Once the attacker controls the email on record, they can trigger a standard password reset and take over the account outright.
The flaw carries a CVSS 3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It is reachable over the network, requires low attack complexity, needs no privileges and no user interaction, and results in high confidentiality, integrity, and availability impact.
Why It Matters
The end state here is full administrator compromise of a WordPress site with no credentials required up front. Nothing about the attack needs a victim to click anything. An attacker who reaches the site over the network can walk directly to an admin account, and an admin account on WordPress means plugin installation, theme file editing, and content control; effectively site-level code execution in practice.
There is no CISA KEV entry for CVE-2026-14349 in the supplied source material, so active exploitation is not confirmed by KEV at this time. The severity and trivial exploitability still warrant priority treatment.
What's Vulnerable
- Vendor: themetechmount
- Product: TrueBooker – Appointment Booking and Scheduler System (WordPress plugin)
- Affected versions: all versions up to and including 1.2.3
Patch Status
The referenced WordPress plugin changeset compares the vulnerable main/function_ajax.php in tag 1.2.3 against tag 1.2.4, indicating the fix landed in 1.2.4. Administrators running 1.2.3 or earlier should update to 1.2.4 or later. No KEV-mandated remediation deadline applies, as the CVE does not appear in the supplied KEV data.
The CVE record was published 2026-09-16 with a vulnerability status of "Received," meaning NVD analysis was still pending at time of writing.