A missing authorization check in the TrueBooker appointment booking plugin lets unauthenticated attackers reset the password of any WordPress account, including administrators.
What Is It
CVE-2026-14365 is an authorization bypass (CWE-862, Missing Authorization) in the TrueBooker – Appointment Booking and Scheduler System plugin for WordPress, published to NVD on 2026-08-07 and reported by Wordfence. The plugin does not properly verify that a user is authorized to perform an action. As a result, unauthenticated attackers can change the password of arbitrary user accounts, including administrator accounts, and then use those credentials to log in.
It carries a CVSS 3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Why It Matters
The CVSS vector describes the worst realistic case for a web plugin flaw: network-reachable, low attack complexity, no privileges required, and no user interaction. There is no authentication step to defeat and nothing for a victim to click. Confidentiality, integrity, and availability impacts are all rated HIGH, consistent with a takeover of the administrator account; which in WordPress means control of the site.
As of publication, CVE-2026-14365 is not listed in the CISA Known Exploited Vulnerabilities catalog, so there is no confirmation of active exploitation and no KEV-mandated remediation deadline. Operators should check the catalog directly for the current status.
What's Vulnerable
- Vendor: themetechmount
- Product: TrueBooker – Appointment Booking and Scheduler System (WordPress plugin)
- Affected versions: all versions up to and including 1.2.3
- Status of other versions: default status is listed as unaffected
Patch Status
The NVD record references a WordPress plugin repository changeset (3595807) for truebooker-appointment-booking. The changeset is cited as a reference for this CVE and appears to carry the relevant code change, though the available data does not confirm it as the complete fix. No fixed version number is stated in the supplied data, and no vendor advisory text or required-action deadline is included. Operators running 1.2.3 or earlier should treat the installation as vulnerable and update to the latest available release from the plugin repository.
Sources
- NVD, CVE-2026-14365: https://nvd.nist.gov/vuln/detail/CVE-2026-14365
- WordPress Plugin Trac changeset 3595807: https://plugins.trac.wordpress.org/changeset/3595807/truebooker-appointment-booking
- Wordfence Threat Intel: https://www.wordfence.com/threat-intel/vulnerabilities/id/afe10c10-cace-4ce4-a813-6fda04c8d3dd?source=cve
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog