CVE-2026-14545 Overview
CVE-2026-14545 is a critical authentication flaw in the TrueBooker WordPress plugin versions prior to 1.2.4. The plugin's front-end account handler fails to validate account ownership when processing password reset requests. Unauthenticated attackers can set an arbitrary password on any user account, including administrators, resulting in full site takeover. The issue is classified under CWE-269: Improper Privilege Management and is exploitable remotely over the network without user interaction.
Critical Impact
Unauthenticated attackers can reset any user's password, including administrators, and gain complete control of affected WordPress sites.
Affected Products
- TrueBooker WordPress plugin versions prior to 1.2.4
- WordPress sites using TrueBooker for front-end booking and account management
- All administrator, editor, and subscriber accounts on vulnerable installations
Discovery Timeline
- 2026-07-28 - CVE-2026-14545 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-14545
Vulnerability Analysis
The TrueBooker plugin exposes front-end account handlers for user self-service actions, including password resets. The vulnerable handler accepts a target username or user identifier alongside a new password value. The handler does not verify that the requesting session owns the referenced account. It also does not require a valid, single-use reset token bound to the account being modified.
An unauthenticated attacker submits a crafted request specifying the administrator username and a chosen password. The handler updates the password in the WordPress user table and returns success. The attacker then authenticates through wp-login.php with the newly set credentials and obtains administrator privileges.
Administrator access enables arbitrary plugin and theme installation, PHP file editing, and database manipulation. This converts the initial takeover into persistent remote code execution on the underlying web host.
Root Cause
The root cause is missing authorization on a privileged state-changing operation, matching CWE-269: Improper Privilege Management. The password reset handler treats attacker-supplied identifiers as trusted and does not verify a reset token, nonce, or session ownership before mutating credentials.
Attack Vector
Exploitation requires only network access to the WordPress site's front end. No authentication, no privileges, and no user interaction are required. The attacker sends a single HTTP POST request to the plugin's password reset endpoint, supplies the target account and desired password, and then logs in normally. See the WPScan Vulnerability Report for endpoint details.
Detection Methods for CVE-2026-14545
Indicators of Compromise
- Unexpected password changes on administrator or privileged WordPress accounts without a preceding retrieve_password email event in logs.
- New administrator accounts, plugin installations, or theme uploads that immediately follow anomalous requests to TrueBooker front-end endpoints.
- Successful wp-login.php authentications from previously unseen IP addresses, closely following POST requests to TrueBooker account handler routes.
- Modifications to wp_users or wp_usermeta tables outside normal administrative workflows.
Detection Strategies
- Inspect web server access logs for POST requests to TrueBooker plugin endpoints, particularly those referencing password reset or account update actions from unauthenticated sessions.
- Correlate password change events with the source IP, user-agent, and prior session activity to identify resets that lack a matching authenticated session.
- Alert on WordPress audit log events where a password is changed for an account other than the acting user, or where the acting user is anonymous.
Monitoring Recommendations
- Deploy file integrity monitoring on wp-content/plugins/truebooker/ and core WordPress directories to catch post-compromise webshell deployment.
- Forward WordPress and web server logs to a centralized analytics platform and build detections for administrator logins that follow front-end plugin POST activity.
- Monitor outbound connections from the web host for command-and-control traffic that typically follows administrator-level takeover.
How to Mitigate CVE-2026-14545
Immediate Actions Required
- Update the TrueBooker plugin to version 1.2.4 or later on every WordPress site in the estate.
- Force a password reset for all administrator and editor accounts and invalidate active sessions.
- Review the WordPress user table for unauthorized accounts and remove any that were not provisioned by legitimate administrators.
- Audit installed plugins, themes, and wp-content/uploads/ for webshells or unexpected PHP files added since the plugin was first installed.
Patch Information
The vendor addressed the flaw in TrueBooker version 1.2.4 by adding account ownership validation to the front-end password reset handler. Refer to the WPScan Vulnerability Report for the fixed version reference.
Workarounds
- If patching is not immediately possible, deactivate and remove the TrueBooker plugin until the update can be applied.
- Restrict access to TrueBooker front-end endpoints at the web application firewall layer, blocking password reset actions from untrusted networks.
- Enforce two-factor authentication on all administrator accounts so that a stolen password alone does not grant console access.
# Verify installed TrueBooker version via WP-CLI and update if vulnerable
wp plugin get truebooker --field=version
wp plugin update truebooker --version=1.2.4
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
