CVE-2026-14364

GitHubCurated repository PoCExploitCexploitintel/eip-pocs-and-cves

PoC files

12 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a Python script (poc/poc.py) that performs an unauthenticated arbitrary password reset against the TrueBooker WordPress plugin (CVE-2026-14364). It scrapes public nonces, sends a crafted AJAX request to reset an administrator's password, and then logs in to confirm account takeover. A control harness (poc/control_test.py) also exercises a sibling vulnerability (CVE-2026-14365).

Backdoor review

No backdoor observed in reviewed code

The supplied text files (README, two Python PoC scripts, and a verification report) describe and implement a proof-of-concept exploit for CVE-2026-14364 and CVE-2026-14365. The code performs only the advertised unauthenticated password reset and login verification against a target WordPress site. No concealed executable behavior, unrelated payload, persistence mechanism, or operator-directed harm is present. Two binary zip files are flagged as uninspected, but the text evidence alone shows no backdoor.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareTrueBooker – Appointment Booking and Scheduler System (WordPress plugin)
Attack typesaccount takeoverauthentication bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The file poc/poc.py is a complete, executable script that actively resets a user's password and logs in to confirm account takeover, which is the definition of exploit code. The README and verification report confirm it was successfully run against a vulnerable lab instance.

poc/poc.py:1-147poc_verification_report.md:5

Requirements

  • Target WordPress site with vulnerable TrueBooker plugin (<=1.2.3) active and the [truebooker-myaccount] shortcode page accessible.poc/poc.py:58-67
  • Target user account (default admin, user ID 1) must have an empty user_activation_key in the WordPress database.README.md:26-31

Observed behavior

  • Scrapes ajax_object.nonce and truebooker_meta_box_noncename from the public /my-account/ page.poc/poc.py:58-67
  • Sends a POST request to /wp-admin/admin-ajax.php with action=user_front_resetpass, a deliberately bogus activation key, and the attacker's chosen new password.poc/poc.py:116-128
  • Logs in to WordPress as the target user with the new password and verifies the presence of a wordpress_logged_in cookie.poc/poc.py:70-84
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Target
target WordPress site (user-supplied URL)The PoC sends HTTP requests to the target to scrape nonces, reset a password, and verify login. This is the expected exploit behavior.poc/poc.py:45poc/poc.py:62poc/poc.py:128
Binary Artifact
assets/truebooker-1.2.3.zip (sha256:16aee95b9d4538a3933401e43d57f250896fcc35b710eb17c3bbb3a6030094dd)Vulnerable plugin zip used in the Docker lab. Not analyzed; metadata only.README.md:65
Binary Artifact
assets/truebooker-1.2.6.zip (sha256:484c3c9309892c954de91f2d9fb5a767750a5a1b1ca2b4e70dd32bb906b6abb5)Fixed plugin zip used in the Docker lab. Not analyzed; metadata only.README.md:65
Review boundaries

What the analysis did not establish

  • Two binary plugin zip files (assets/truebooker-1.2.3.zip, assets/truebooker-1.2.6.zip) are present but not analyzed; their contents are not needed to classify the text-based exploit code.
  • The verification report references artifact files (e.g., artifacts/poc_run.txt) that are not included in the provided text evidence, but the report itself and the exploit code are sufficient for classification.
  • Two binary zip files (assets/truebooker-1.2.3.zip, assets/truebooker-1.2.6.zip) were flagged as BINARY and not analyzed. Their contents could theoretically contain unrelated malicious code, but the text-based PoC does not depend on executing them.
  • The review is limited to the supplied text evidence; no runtime behavior or network traffic was observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

2
GitHub

CVE-2026-14364/docker-compose.control.yml

Created Vuln labCVE-2026-14364Compose · images

1 Compose manifest · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for a WordPress lab with MariaDB, designed to demonstrate CVE-2026-14364, an unauthenticated password reset vulnerability in the TrueBooker plugin. The control Compose file defines a fixed version of the plugin for comparison.

CVE-2026-14364/docker-compose.control.yml:1-31CVE-2026-14364/README.md:1-98

Lab assessment

Vulnerability lab

The README explicitly describes a reproducible Docker lab for CVE-2026-14364, with instructions to run a vulnerable environment and a fixed control environment, and includes exploit and control test scripts.

CVE-2026-14364/README.md:1-98
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

database

MariaDB 11 database service for WordPress, configured with a root password, a WordPress database, and a WordPress user. Includes a healthcheck using mariadb-admin ping.

CVE-2026-14364/docker-compose.control.yml:4-14

web

web serverWordPress application

WordPress with Apache, depends on the db service being healthy. Exposes port 8081 (or CONTROL_WEB_PORT) on the host, mounts the local assets directory as read-only, and sets WordPress debug mode.

CVE-2026-14364/docker-compose.control.yml:16-31

seed.sh

lab seeder

Bash script that seeds the lab or control environment by installing WP-CLI, installing WordPress core, activating the specified TrueBooker plugin zip, creating test users, and setting up a 'My Account' page with the plugin shortcode.

CVE-2026-14364/seed.sh:1-73

poc.py

exploit script

Python 3 script that exploits CVE-2026-14364 by scraping public nonces, performing a negative login control, sending a crafted AJAX request to reset the admin password, and verifying the takeover via login.

CVE-2026-14364/poc/poc.py:1-147

control_test.py

control harness

Python 3 script that tests both CVE-2026-14364 and CVE-2026-14365 vectors against a target, reporting whether each is exploitable. Used to verify the fix on the control build.

CVE-2026-14364/poc/control_test.py:1-144
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-14364

Supported by supplied evidence

The README, PoC script, and control test script all describe and implement an unauthenticated password reset via the user_front_resetpass AJAX action, consistent with the CVE description. The control Compose file and seed script support testing the fix.

CVE-2026-14364/README.md:1-98CVE-2026-14364/poc/poc.py:1-147CVE-2026-14364/poc/control_test.py:1-144
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the lab.CVE-2026-14364/README.md:60-62
  • The vulnerable TrueBooker plugin zip (truebooker-1.2.3.zip) must be present in the assets directory for the lab environment.CVE-2026-14364/seed.sh:10-11
  • The fixed TrueBooker plugin zip (truebooker-1.2.6.zip) must be present in the assets directory for the control environment.CVE-2026-14364/seed.sh:13-14
  • Python 3 is required to run the exploit and control test scripts.CVE-2026-14364/poc/poc.py:1CVE-2026-14364/poc/control_test.py:1

Evidence-described exercise path

  1. Start the vulnerable lab environment with 'docker compose up -d' and seed it with 'bash seed.sh lab'.CVE-2026-14364/README.md:60-62
  2. Run the exploit script against the vulnerable target: 'python3 -u poc/poc.py http://localhost:8080'.CVE-2026-14364/README.md:65-66
  3. Start the fixed control environment with 'docker compose -p cve-2026-14364-control -f docker-compose.control.yml up -d' and seed it with 'bash seed.sh control'.CVE-2026-14364/README.md:63-64
  4. Run the exploit script against the fixed target to confirm the fix: 'python3 -u poc/poc.py http://localhost:8081'.CVE-2026-14364/README.md:68-69
  5. Run the two-vector control harness on both environments to verify both CVE-2026-14364 and CVE-2026-14365: 'python3 -u poc/control_test.py http://localhost:8080' and 'python3 -u poc/control_test.py http://localhost:8081'.CVE-2026-14364/README.md:71-72
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own WordPress target. The exploit and control scripts only interact with the lab containers via HTTP to demonstrate the vulnerability. The Compose file mounts a local assets directory read-only and exposes a port, which are standard lab requirements. No evidence of host escape, external connections, persistence, credential theft, or destructive actions beyond the intended lab target.

CVE-2026-14364/docker-compose.control.yml:1-31CVE-2026-14364/poc/poc.py:1-147CVE-2026-14364/poc/control_test.py:1-144CVE-2026-14364/seed.sh:1-73
Review boundaries

What the analysis did not establish

  • The docker-compose.yml for the vulnerable lab is not included in the evidence files, only the control compose file is present.
  • The plugin zip files (truebooker-1.2.3.zip and truebooker-1.2.6.zip) are uninspected binaries.
  • The seed.sh script downloads WP-CLI from an external URL (raw.githubusercontent.com) at runtime, which is a supply-chain risk but necessary for the lab setup.
  • The sibling CVE-2026-14365 is mentioned in the README and control test script but is not in the unit_cve_ids array, so it is not assessed.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted

GitHub

CVE-2026-14364/docker-compose.yml

Created Vuln labCVE-2026-14364Compose · images

1 Compose manifest · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for a WordPress lab with MariaDB, designed to reproduce and verify CVE-2026-14364, an unauthenticated arbitrary password reset vulnerability in the TrueBooker plugin. It includes a vulnerable version (1.2.3) and a fixed control version (1.2.6) via separate compose files and a seeding script.

CVE-2026-14364/docker-compose.yml:1-29CVE-2026-14364/README.md:1-98

Lab assessment

Vulnerability lab

The README explicitly describes a reproducible Docker lab for CVE-2026-14364, including vulnerable and control environments, exploit scripts, and verification steps. The compose file sets up a WordPress instance with a bind-mounted assets directory containing the vulnerable plugin.

CVE-2026-14364/README.md:1-98CVE-2026-14364/docker-compose.yml:1-29
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

database server

MariaDB 11 service providing the WordPress database. Configured with environment variables for root password, database name, user, and password. Includes a healthcheck using mariadb-admin ping.

CVE-2026-14364/docker-compose.yml:2-12

web

web serverWordPress application

WordPress Apache service exposing port 80, mapped to host port 8080 (or WEB_PORT). Depends on the db service being healthy. Mounts the local ./assets directory as read-only at /assets, which contains the vulnerable and fixed plugin zip files. WordPress debug mode is enabled.

CVE-2026-14364/docker-compose.yml:14-29

seed.sh

lab seederenvironment initializer

Bash script that seeds the lab or control environment. Installs WP-CLI, installs WordPress core, activates the specified plugin (vulnerable 1.2.3 or fixed 1.2.6), creates test users, and sets up the My Account page with the required shortcode.

CVE-2026-14364/seed.sh:1-73

poc.py

exploit scriptproof-of-concept

Python 3 script that exploits CVE-2026-14364 by scraping public nonces, sending a crafted AJAX request to reset the admin password, and verifying login. Targets the vulnerable WordPress instance.

CVE-2026-14364/poc/poc.py:1-147

control_test.py

control harnessverification script

Python 3 script that tests both CVE-2026-14364 (vector A) and CVE-2026-14365 (vector B) against a target. Used to confirm exploitability on the vulnerable build and non-exploitability on the fixed build.

CVE-2026-14364/poc/control_test.py:1-144

assets/truebooker-1.2.3.zip

vulnerable plugin archive

Binary zip file containing the vulnerable version (1.2.3) of the TrueBooker plugin. Mounted read-only into the web container for installation.

CVE-2026-14364/docker-compose.yml:28CVE-2026-14364/seed.sh:10

assets/truebooker-1.2.6.zip

fixed plugin archive

Binary zip file containing the fixed version (1.2.6) of the TrueBooker plugin. Used in the control environment to verify the patch.

CVE-2026-14364/seed.sh:13
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-14364

Supported by supplied evidence

The README, PoC script, and verification report all describe and demonstrate an unauthenticated arbitrary password reset in TrueBooker <= 1.2.3, matching the CVE description. The lab provides a vulnerable environment and a fixed control to confirm the vulnerability.

CVE-2026-14364/README.md:1-98CVE-2026-14364/poc/poc.py:1-147CVE-2026-14364/poc_verification_report.md:1-36
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host.CVE-2026-14364/README.md:56-58
  • Python 3 with standard library available to run the exploit scripts.CVE-2026-14364/README.md:63-65
  • The vulnerable lab must be started with 'docker compose up -d' and seeded with 'bash seed.sh lab' before exploitation.CVE-2026-14364/README.md:57-58

Evidence-described exercise path

  1. Start the vulnerable lab: 'docker compose up -d' then 'bash seed.sh lab'.CVE-2026-14364/README.md:57-58
  2. Run the PoC exploit against the vulnerable target: 'python3 -u poc/poc.py http://localhost:8080'. Expect [SUCCESS].CVE-2026-14364/README.md:63-64
  3. Optionally, start the fixed control environment: 'docker compose -p cve-2026-14364-control -f docker-compose.control.yml up -d' and 'bash seed.sh control'.CVE-2026-14364/README.md:60-61
  4. Run the PoC against the fixed control: 'python3 -u poc/poc.py http://localhost:8081'. Expect [FAILED].CVE-2026-14364/README.md:66-67
  5. Run the two-vector control harness on both environments to verify both CVE-2026-14364 and CVE-2026-14365.CVE-2026-14364/README.md:69-70
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own WordPress target. The exploit scripts only interact with the local Docker containers via HTTP to demonstrate the password reset vulnerability. There is no evidence of host escape, external connections, persistence, credential theft, or destructive actions outside the intended lab scope.

CVE-2026-14364/poc/poc.py:1-147CVE-2026-14364/poc/control_test.py:1-144CVE-2026-14364/seed.sh:1-73
Review boundaries

What the analysis did not establish

  • The docker-compose.control.yml file is referenced but not included in the evidence files, so its exact content is unknown.
  • The plugin zip files (truebooker-1.2.3.zip and truebooker-1.2.6.zip) are binary and uninspected; their contents are not verified.
  • The lab relies on downloading WP-CLI from an external URL during seeding, which is a supply-chain risk but not inherently malicious.
  • The sibling CVE-2026-14365 is mentioned but not part of the unit_cve_ids; its assessment is out of scope.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted

Linked vulnerabilities

2