CVE-2026-14349: TrueBooker WordPress Authorization Bypass

CVE-2026-14349 Overview

CVE-2026-14349 is an authorization bypass vulnerability in the TrueBooker – Appointment Booking and Scheduler System plugin for WordPress. The flaw affects all versions up to and including 1.2.3. The plugin fails to verify that a user is authorized to perform certain actions, allowing unauthenticated attackers to modify the email address of arbitrary user accounts, including administrators. Attackers can leverage this to trigger a password reset against the modified email and gain full control of the targeted account. The issue is tracked under CWE-862: Missing Authorization.

Critical Impact
Unauthenticated attackers can hijack administrator accounts on any WordPress site running TrueBooker 1.2.3 or earlier, resulting in complete site compromise.

Affected Products

TrueBooker – Appointment Booking and Scheduler System plugin for WordPress
All versions up to and including 1.2.3
Fixed in version 1.2.4

Discovery Timeline

2026-09-16 - CVE-2026-14349 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-14349

Vulnerability Analysis

The vulnerability resides in the AJAX handler logic within main/function_ajax.php of the TrueBooker plugin. The affected function processes user-profile update requests, including changes to the email address stored on a WordPress user account. The handler does not confirm that the requester owns the target account or holds administrative privileges before applying the change.

Because the endpoint is exposed through the WordPress AJAX interface without an authentication or capability check, any remote client can invoke it. By supplying a target user identifier and a new email address, an attacker can overwrite the email on record for any account, including accounts with the administrator role.

Once the email address is changed, the attacker requests a standard WordPress password reset for the targeted username. The reset link is delivered to the attacker-controlled address, granting full account takeover. Vendor remediation details are documented in the WordPress plugin change log and the Wordfence vulnerability report.

Root Cause

The root cause is missing authorization ([CWE-862]) on the AJAX action that mutates user profile fields. The plugin relies on the presence of an AJAX request rather than validating the current user's identity and capabilities. Nonce verification and current_user_can() checks are absent from the vulnerable code path.

Attack Vector

Exploitation is remote, unauthenticated, and requires no user interaction. An attacker sends a crafted HTTP POST request to the plugin's AJAX endpoint on the target WordPress site, specifying a victim account and a controlled email address. The attacker then triggers the built-in WordPress password reset flow to receive the reset token at that address.

Exploitation code is not required beyond a standard HTTP client. See the referenced Wordfence advisory for technical details.

Detection Methods for CVE-2026-14349

Indicators of Compromise

Unexpected changes to the user_email field on wp_users records, particularly for administrator accounts.
WordPress password reset emails sent to unfamiliar external addresses shortly after suspicious AJAX traffic.
Successful wp-login.php sessions from new geolocations following an email change event.

Detection Strategies

Inspect web server access logs for unauthenticated POST requests to /wp-admin/admin-ajax.php referencing TrueBooker action names.
Correlate WordPress audit log entries for user_email updates with the absence of an authenticated administrator session at the same timestamp.
Alert on password-reset events immediately preceded by profile modification requests originating from the same IP.

Monitoring Recommendations

Enable database-level auditing on the wp_users and wp_usermeta tables to capture email address modifications.
Forward WordPress and web server logs to a centralized analytics platform for cross-source correlation.
Monitor outbound mail queues for password reset messages directed to newly introduced email domains.

How to Mitigate CVE-2026-14349

Immediate Actions Required

Update the TrueBooker – Appointment Booking and Scheduler System plugin to version 1.2.4 or later on every affected WordPress site.
Audit all administrator and privileged accounts for unauthorized email address changes and revert any that are unrecognized.
Force a password reset for every administrator account and invalidate active sessions.

Patch Information

The vendor addressed the vulnerability in TrueBooker version 1.2.4. The patch adds authorization enforcement to the affected AJAX handler in main/function_ajax.php. Review the diff in the WordPress plugin change log to confirm the fix scope.

Workarounds

Deactivate and remove the TrueBooker plugin until the upgrade to 1.2.4 can be applied.
Restrict access to /wp-admin/admin-ajax.php at the web application firewall to block unauthenticated requests targeting TrueBooker actions.
Enforce two-factor authentication on all administrator accounts so a hijacked password reset alone does not grant access.

bash

# Verify the installed TrueBooker plugin version using WP-CLI
wp plugin get truebooker-appointment-booking --field=version

# Upgrade to the patched release
wp plugin update truebooker-appointment-booking --version=1.2.4