TrueBooker WordPress Plugin Critical Flaw

The TrueBooker Appointment Booking and Scheduler System plugin for WordPress contains a critical authorization bypass vulnerability, tracked as CVE-2026-14365. This flaw, which affects all versions up to and including 1.2.3, allows unauthenticated attackers to change the passwords of arbitrary user accounts on a site, effectively granting them full administrative control.

What's at Risk

This vulnerability impacts any WordPress site running the TrueBooker plugin version 1.2.3 or older. Because the flaw is accessible to unauthenticated users, any internet-facing website utilizing this plugin for scheduling or booking is at immediate risk. The severity is marked as critical, with a CVSS score of 9.8, reflecting the ease of exploitation and the total compromise of account integrity that can result from a successful attack.

How the Flaw Works

This vulnerability stems from a failure to perform proper authorization checks on administrative functions. In web applications, authorization refers to the process of verifying whether a user has the necessary permissions to perform a specific action. When a plugin fails to validate these permissions, it creates an authorization bypass. Typically, this occurs when an application assumes a request is legitimate simply because it is formatted correctly, without checking the identity or the current session status of the requester. This class of weakness allows attackers to perform sensitive operations—such as modifying user data, changing credentials, or escalating privileges—by sending specially crafted requests to the server, bypassing the expected security controls intended to protect these administrative endpoints.

How to Protect Your Systems

• Update the TrueBooker plugin to the latest available version immediately.
• Audit all user accounts for suspicious activity or unauthorized password changes.
• Enforce Multi-Factor Authentication (MFA) for all administrative accounts to mitigate the impact of compromised credentials.
• Restrict access to administrative interfaces by whitelisting trusted IP addresses where feasible.
• Regularly monitor system logs for unusual authentication patterns or account modifications.

Given the critical nature of this vulnerability and the potential for complete site takeover, prompt action is required. Organizations should treat this as a high-priority update to prevent unauthorized access to their WordPress environments and protect the integrity of their user accounts.