CVE-2026-14545: TrueBooker WordPress Plugin Lets Anyone Take Over Admin Accounts

Executive Summary

A critical authentication bypass vulnerability in the TrueBooker WordPress booking plugin allows any unauthenticated attacker to reset the password of any WordPress account — including site administrators — and immediately gain full administrative access. No credentials, token, or email confirmation is needed.

CVSS Score: 9.8 (Critical)

All TrueBooker versions prior to 1.2.4 are affected. Update immediately. This is the second critical access control failure in the TrueBooker line following CVE-2026-48881 (CVSS 9.1, patched in v1.2.0), indicating the plugin's authorization logic was not comprehensively remediated in the earlier fix.

Vulnerability Overview

Affected Versions

Technical Details

TrueBooker exposes a front-end account management handler that processes password reset requests. The handler accepts a target username and a new password, but performs no validation that the requesting party owns or controls the target account. There is no token exchange, no email verification link, and no session check. An attacker can submit a single HTTP POST to reset the password of any account — including those with administrator role — and immediately log in with the new credentials.

Exploitation Flow

1. Attacker enumerates a WordPress username (e.g. via /wp-json/wp/v2/users or login error messages)
2. Attacker sends a crafted POST to TrueBooker's front-end reset handler:
   POST /wp-admin/admin-ajax.php
   action=truebooker_reset_password&username=admin&new_password=attacker_controlled
3. Plugin sets the new password without verifying account ownership
4. Attacker logs in as admin with the new password
5. Full site compromise — install plugins, exfiltrate data, deploy webshells

What an Attacker Can Do as WordPress Admin

Remediation

Step 1: Update Immediately

Update via WordPress admin (Plugins > Installed Plugins > TrueBooker > Update Now) or using WP-CLI:

wp plugin update truebooker
 
# Verify updated version
wp plugin get truebooker --field=version
# Expected: 1.2.4 or higher

Step 2: If Immediate Patching Is Not Possible

# Temporarily deactivate the plugin until patch can be applied
wp plugin deactivate truebooker

Alternatively, deploy a WAF rule to block POST requests to TrueBooker's reset handler endpoint until the update can be applied.

Step 3: Audit for Prior Compromise

If the site may have been exposed while running a vulnerable version, audit immediately:

# Check for unexpected admin accounts added
wp user list --role=administrator
 
# Check for recently modified plugin/theme files
find /path/to/wp-content/ -name "*.php" -newer /path/to/wp-includes/version.php -type f
 
# Look for webshell signatures
grep -rl "eval\s*(base64_decode" /path/to/wp-content/
grep -rl "system\s*(\$_" /path/to/wp-content/
 
# Verify WordPress core integrity
wp core verify-checksums

Step 4: Post-Incident Recovery

1. Rotate all administrator passwords — even patched accounts may have been silently reset
2. Revoke and regenerate all API keys stored in WordPress options
3. Regenerate WordPress security keys: wp config shuffle-salts
4. Review all installed plugins and themes for unexpected additions
5. Check scheduled tasks (wp-cron) for attacker-added persistence
6. Scan with a malware scanner (Wordfence, MalCare, or Sucuri)

Detection Indicators

References

• NIST NVD — CVE-2026-14545
• Patchstack — TrueBooker Plugin Vulnerabilities
• CWE-269: Improper Privilege Management

Related Reading

• Critical RCE in WPvivid Backup Plugin Threatens 900,000+
• WordPress Plugin Vulnerability (CVSS 10.0) Under Active Exploitation