CVE-2026-14545: Unknown Truebooker

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.

Affected products

• Unknown Truebooker: before 1.2.4 (fixed in 1.2.4)

Published 2026-07-28. Last modified 2026-07-28.