Executive Summary
A second critical vulnerability (CVE-2026-14365) has been disclosed in the TrueBooker – Appointment Booking and Scheduler System plugin for WordPress. This flaw is distinct from the related password reset bypass (CVE-2026-14364) — here, the plugin fails to verify whether an authenticated or unauthenticated user is authorized to perform a password change action at all, allowing any external attacker to directly overwrite any user's password.
CVSS Score: 9.8 (Critical)
Reported by Wordfence, the vulnerability is classified as CWE-862 (Missing Authorization). Together with CVE-2026-14364, it represents a severe twin authentication failure in TrueBooker versions up to and including 1.2.3. Both are patched in changeset 3595807.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-14365 |
| CVSS Score | 9.8 (Critical) |
| Weakness | CWE-862 (Missing Authorization) |
| Type | Authorization Bypass — Unauthenticated Password Change |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| CISA Automatable | Yes |
| CISA Technical Impact | Total |
Affected Versions
| Plugin | Affected Versions | Fixed Version |
|---|---|---|
| TrueBooker – Appointment Booking and Scheduler System | <= 1.2.3 | 1.2.4+ (changeset 3595807) |
Technical Details
CVE-2026-14365 vs CVE-2026-14364
These two CVEs describe distinct but related failures in the same plugin:
| CVE-2026-14364 | CVE-2026-14365 | |
|---|---|---|
| Weakness | CWE-640 — Weak Password Recovery | CWE-862 — Missing Authorization |
| Attack Path | Abuses the reset flow; identity not verified | Directly changes password; no authorization check at all |
| Target | Password reset endpoint | Password change endpoint / action |
CWE-862: Missing Authorization
The plugin implements a password change action without verifying that the requesting user has authorization to change the target account's password. This is a fundamental access control failure: the function exists but no capability or nonce check gates it. An unauthenticated attacker can call the action directly, supplying any user ID as the target, and the plugin will update the password without question.
Attack Flow
1. Attacker identifies a WordPress site running TrueBooker <= 1.2.3
2. Attacker directly calls the password change action/endpoint
3. Attacker supplies a target user ID (e.g., user ID 1 = admin)
4. Plugin executes password change without any authorization check
5. Attacker logs in as the target user with the new password
6. Full site compromisePotential Impact
| Impact | Description |
|---|---|
| Administrator Takeover | Direct access to all WordPress admin functions |
| Content Manipulation | Modify, delete, or inject content across the site |
| Data Theft | Exfiltrate all stored booking, customer, and payment data |
| Plugin/Theme Abuse | Install malicious code via admin file editor |
| Supply Chain Risk | Use compromised site to attack visitors |
Why This Pair of CVEs Is Especially Dangerous
CVE-2026-14364 and CVE-2026-14365 both exist in the same plugin version and share the same patch. The combination means an attacker has two distinct code paths to achieve the same outcome — full account takeover without authentication. Even if one path were mitigated by a WAF rule, the other would likely succeed. Sites running TrueBooker <= 1.2.3 should treat this as a high-urgency remediation.
CISA's SSVC assessment marks both as automatable with total technical impact, meaning mass exploitation via automated scanners is realistic.
Remediation
Step 1: Update Immediately
Both CVE-2026-14364 and CVE-2026-14365 are fixed in the same changeset (3595807). Update via WP-CLI or WordPress Admin:
# Update via WP-CLI
wp plugin update truebooker-appointment-booking
# Confirm version
wp plugin get truebooker-appointment-booking --field=versionStep 2: Assume Compromise if Not Patched Promptly
Given that both vulnerabilities are automatable, sites that were running TrueBooker <= 1.2.3 for any period after 2026-08-07 should treat themselves as potentially compromised and conduct a full incident response:
# Check for unexpected admin accounts
wp user list --role=administrator
# Scan for recently modified plugin/theme files
find /path/to/wordpress/wp-content/ -type f -newer /path/to/wordpress/wp-login.php
# Verify WordPress core files haven't been tampered with
wp core verify-checksumsStep 3: Harden Password Change Controls
After patching, ensure your broader WordPress environment has layered defenses:
- Enable two-factor authentication for all administrator accounts
- Restrict login by IP using your WAF or security plugin if possible
- Enable WordPress activity logging (plugins: WP Activity Log, Simple History)
- Disable the XML-RPC interface if not required (
/xmlrpc.php) - Deploy a WAF (Wordfence, Sucuri, Cloudflare) with WordPress ruleset
Detection Indicators
| Indicator | Description |
|---|---|
| POST requests to TrueBooker AJAX/REST actions | Exploitation attempts |
| Login events for admin accounts from unknown IPs | Post-compromise access |
| New admin user accounts | Attacker persistence |
| Password change events not initiated by the user | Direct exploitation indicator |
References
- Wordfence Threat Intel — CVE-2026-14365
- WordPress Plugin Trac — Changeset 3595807
- NVD — CVE-2026-14365