A critical flaw (CVSS 9.8) in the TrueBooker – Appointment Booking and Scheduler System plugin for WordPress lets unauthenticated attackers reset the password of any account, including administrators.
What Is It
TrueBooker fails to properly validate a user's identity before resetting their password. The result is a classic weak password recovery mechanism (CWE-640): an unauthenticated attacker can trigger a password reset against an arbitrary account and take it over outright.
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base score 9.8, CRITICAL. Network-reachable, low complexity, no privileges, no user interaction, with high impact to confidentiality, integrity, and availability.
Why It Matters
There is no user interaction requirement and no authentication barrier. An attacker who can reach the site can reset an administrator's password and inherit full control of the WordPress installation. Full admin access on a WordPress site is effectively total compromise of the site and everything served from it.
The CISA Known Exploited Vulnerabilities catalog (version 2026.08.06, 1,661 entries) contains no entry for this CVE, so there is no confirmed active exploitation on record at this time. The CVSS exploitability subscore is 3.9, the maximum for the metric.
What's Vulnerable
- Vendor: themetechmount
- Product: TrueBooker – Appointment Booking and Scheduler System (WordPress plugin)
- Affected versions: all versions up to and including 1.2.3
No CPE entries have been published for this record yet.
Patch Status
The record is in Received status at NVD as of 2026-08-07 and was assigned by Wordfence. The supplied data does not state a fixed version number, but a WordPress plugin repository changeset (3595807) for truebooker-appointment-booking is referenced alongside the advisory, indicating upstream code changes tied to this issue.
Because the CVE is absent from the KEV catalog, it carries no BOD 22-01 required action or federal remediation deadline. Operators running 1.2.3 or earlier should treat the plugin as vulnerable and review the referenced changeset for the current upstream state.