critical9.8
CVE-2026-14545
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers…
Impact
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.
Affected products
| Product | Affected versions |
|---|---|
| TrueBooker WordPress Plugin | before 1.2.4 |
Versions were read from the advisory text. No structured product data has been published for this record yet.