Critical TrueBooker Plugin Flaw Enables Unauthenticated Admin Account Takeover

Executive Summary

A critical authorization bypass vulnerability (CVE-2026-14349) has been disclosed in TrueBooker – Appointment Booking and Scheduler System, a WordPress plugin from ThemeTechMount used to run appointment/booking flows on client sites. The vulnerability carries a CVSS score of 9.8 and requires no authentication and no user interaction to exploit.

CVSS Score: 9.8 (Critical)

The plugin fails to properly verify that a user is authorized to perform an action on one of its AJAX endpoints. As a result, an unauthenticated attacker can change the email address on any user account — including administrator accounts — and then trigger the standard WordPress "forgot password" flow to have the reset link sent to an address they control. That single missing authorization check is enough to fully take over a site. The issue is fixed in version 1.2.4.

Vulnerability Overview

Affected Versions

The WordPress.org changelog for TrueBooker 1.2.4 lists "fixed vulnerabilities related to unauthorized user account modification and potential account takeover" alongside broader authorization and server-side validation hardening across the plugin's AJAX endpoints — consistent with this disclosure. Sites running 1.2.3 or earlier should treat this as urgent.

Attack Vector

1. Attacker identifies a WordPress site running TrueBooker <= 1.2.3
2. Attacker sends an unauthenticated request to a TrueBooker AJAX action
   that updates a user's account email, supplying an arbitrary target
   user ID (e.g. the site administrator, ID 1)
3. The plugin does not verify the requester is authorized to modify that
   account, and updates the email address on record
4. Attacker triggers the standard WordPress "Lost your password?" flow
   for that account
5. The password reset link is delivered to the attacker-controlled
   email address instead of the legitimate owner's
6. Attacker sets a new password and logs in with full administrator
   privileges

Impact of Successful Exploitation

Immediate Remediation

Step 1: Update to Version 1.2.4 or Later

# Via WP-CLI
wp plugin update truebooker-appointment-booking
 
# Verify the installed version
wp plugin get truebooker-appointment-booking --field=version

Or update through WordPress admin: Plugins > Installed Plugins > TrueBooker > Update Now.

Step 2: Audit Administrator Accounts

Because this flaw can be used to silently change an account's email address, review admin and manager accounts for emails that do not match your records.

# List all administrator accounts and their registered email addresses
wp user list --role=administrator --fields=ID,user_login,user_email

Step 3: Force a Password Reset for All Privileged Accounts

# Regenerate WordPress security keys/salts to invalidate existing sessions
wp config shuffle-salts
 
# Reset passwords for admin-level users after confirming their email
# addresses are correct
wp user reset-password <user_id>

If Immediate Patching Is Not Possible

1. Deactivate the TrueBooker plugin until it can be updated
2. Block access to TrueBooker's AJAX/admin-ajax actions at the web server or WAF level if the plugin must remain active
3. Monitor access and audit logs for unexpected admin-ajax.php POST requests referencing TrueBooker actions
4. Enable email-change and password-reset notifications so account owners are alerted to changes they did not make

Detection Indicators

Post-Remediation Steps

1. Confirm plugin updated to 1.2.4 or later
2. Verify every admin/manager account's email address matches its legitimate owner
3. Rotate all credentials — WordPress admin, database, API keys
4. Regenerate WordPress security keys using wp config shuffle-salts
5. Review the user list for unauthorized administrators added after a suspected compromise window
6. Scan the installation for webshells or unauthorized file changes if takeover is suspected
7. Deploy a WAF (Wordfence, Sucuri) for ongoing protection against authorization-bypass exploitation attempts
8. Enable two-factor authentication for all privileged accounts going forward

References

• NIST NVD — CVE-2026-14349
• Wordfence Threat Intelligence — TrueBooker ≤ 1.2.3 Missing Authorization Vulnerabilities
• WordPress.org — TrueBooker Appointment Booking Plugin Changelog

Related Reading

• CVE-2026-9055: Amelia WordPress Plugin Privilege Escalation Vulnerability
• Critical TranslatePress Flaw Exposes 400,000+ WordPress Sites to Account Takeover
• CVE-2026-9701: WordPress Eventer Plugin — Insecure Password Reset Enables Account Takeover