Account Takeover Vulnerability in TrueBooker WordPress Plugin

The TrueBooker - Appointment Booking and Scheduler System plugin for WordPress (versions 1.2.3 and below) contains a critical security flaw categorized as CWE-640: Weak Password Recovery Mechanism for Forgotten Password. The vulnerability stems from the plugin's failure to properly validate a user's identity during the password reset workflow. Because the identity check is absent, an unauthenticated attacker can supply a target user's identifier - such as an administrator account - to the password reset endpoint, triggering a password change or reset without authorization. This allows for full account takeover and subsequent persistent access to the WordPress environment. Given the critical CVSS 3.1 score of 9.8, this vulnerability poses a severe risk to any organization utilizing the plugin for scheduling services.

Attack Chain

1. Attacker performs reconnaissance to identify sites running the TrueBooker plugin.
2. Attacker probes the WordPress application to locate the password reset endpoint provided by the TrueBooker plugin.
3. Attacker identifies a target user's username or email address (e.g., an administrator).
4. Attacker submits a forged password reset request to the vulnerable endpoint.
5. The plugin fails to perform server-side verification of the requestor's identity, accepting the reset request.
6. The plugin updates the password or facilitates a reset for the targeted account.
7. Attacker logs in to the application as the compromised user.
8. Attacker gains full administrative control, potentially deploying further backdoors or exfiltrating sensitive appointment data.

Impact

Successful exploitation leads to a total account takeover, granting attackers administrative access to the WordPress site. Potential consequences include unauthorized access to customer appointment data, modification of site content, installation of web shells for persistent access, and the potential for lateral movement within the hosting infrastructure.

Recommendation

• Update the TrueBooker - Appointment Booking and Scheduler System plugin to the latest version immediately to remediate CVE-2026-14364.
• Monitor web server logs for suspicious or high-frequency POST requests targeting password reset endpoints associated with the plugin (look for unusual source IPs or volume).
• Conduct an audit of WordPress administrator accounts for suspicious activity or recent unauthorized password changes.
• Disable the plugin temporarily if an immediate update is not feasible.