CVE-2026-14545— TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-14545
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset
Source: CVE Program / CVE List V5
Vulnerability Description
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | TrueBooker | 0 ~ 1.2.4 | - |
II. Public POCs for CVE-2026-14545
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14545
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14545 (1)
- 🔗 TrueBooker Appointment Booking < 1.2.4 – Unauthenticated Account Takeover via Password Reset | CVE 2026-14545 | Plugin Vulnerabilities Read full article exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-07-28 · 6 CVEs total
| CVE-2026-14926 | FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR | |
| CVE-2026-14924 | Tablesome < 1.1.31 - Unauthenticated Post Creation and Modification | |
| CVE-2026-14870 | Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id | |
| CVE-2026-14821 | Quiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Template Deletion | |
| CVE-2026-14819 | Event Tickets < 5.28.4 - Editor+ Stored XSS via Ticket Move |
IV. Related Vulnerabilities
Same product: TrueBooker
- CVE-2026-61951
WordPress TrueBooker plugin <= 1.2.3 - Privilege Escalation - CVE-2026-61950
WordPress TrueBooker plugin <= 1.2.3 - SQL Injection vulnera - CVE-2026-48881
WordPress TrueBooker plugin <= 1.1.9 - Broken Access Control - CVE-2026-39663
WordPress TrueBooker plugin <= 1.1.5 - Broken Access Control - CVE-2025-67581
WordPress TrueBooker plugin <= 1.1.0 - Broken Access Control
Same vendor: Unknown
- CVE-2026-14926
FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method - CVE-2026-14924
Tablesome < 1.1.31 - Unauthenticated Post Creation and Modif - CVE-2026-14870
Database for Contact Form 7, WPforms, Elementor forms < 1.5. - CVE-2026-14821
Quiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Tem - CVE-2026-14819
Event Tickets < 5.28.4 - Editor+ Stored XSS via Ticket Move
V. Comments for CVE-2026-14545
No comments yet