CVE-2026-14365

CRITICAL

TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id'

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-14365 has a selected CVSS score of 9.8 (critical); EIP currently links 1 curated repository PoC.

Description

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to change the password of arbitrary user accounts, including administrators, which can be leveraged to gain access to those accounts.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 7, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

TrueBooker – Appointment Booking and Scheduler System

Browse themetechmount / TrueBooker – Appointment Booking and Scheduler System

Default status: unaffected

CVE ListThrough 1.2.3affected

Proofs of concept

1

Curated repository PoCs

GitHubCVE-2026-14364Curated repository PoCby exploitintel8Exploit12 files

C · 18.9 MiB · linked to 2 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a Python script (poc/poc.py) that performs an unauthenticated arbitrary password reset against the TrueBooker WordPress plugin (CVE-2026-14364). It scrapes public nonces, sends a crafted AJAX request to reset an administrator's password, and then logs in to confirm account takeover. A control harness (poc/control_test.py) also exercises a sibling vulnerability (CVE-2026-14365).

Backdoor review

No backdoor observed in reviewed code

The supplied text files (README, two Python PoC scripts, and a verification report) describe and implement a proof-of-concept exploit for CVE-2026-14364 and CVE-2026-14365. The code performs only the advertised unauthenticated password reset and login verification against a target WordPress site. No concealed executable behavior, unrelated payload, persistence mechanism, or operator-directed harm is present. Two binary zip files are flagged as uninspected, but the text evidence alone shows no backdoor.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareTrueBooker – Appointment Booking and Scheduler System (WordPress plugin)
Attack typesaccount takeoverauthentication bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The file poc/poc.py is a complete, executable script that actively resets a user's password and logs in to confirm account takeover, which is the definition of exploit code. The README and verification report confirm it was successfully run against a vulnerable lab instance.

poc/poc.py:1-147poc_verification_report.md:5

Requirements

  • Target WordPress site with vulnerable TrueBooker plugin (<=1.2.3) active and the [truebooker-myaccount] shortcode page accessible.poc/poc.py:58-67
  • Target user account (default admin, user ID 1) must have an empty user_activation_key in the WordPress database.README.md:26-31

Observed behavior

  • Scrapes ajax_object.nonce and truebooker_meta_box_noncename from the public /my-account/ page.poc/poc.py:58-67
  • Sends a POST request to /wp-admin/admin-ajax.php with action=user_front_resetpass, a deliberately bogus activation key, and the attacker's chosen new password.poc/poc.py:116-128
  • Logs in to WordPress as the target user with the new password and verifies the presence of a wordpress_logged_in cookie.poc/poc.py:70-84
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Target
Payload withheldThe PoC sends HTTP requests to the target to scrape nonces, reset a password, and verify login. This is the expected exploit behavior.poc/poc.py:45poc/poc.py:62poc/poc.py:128
Binary Artifact
Payload withheldVulnerable plugin zip used in the Docker lab. Not analyzed; metadata only.README.md:65
Binary Artifact
Payload withheldFixed plugin zip used in the Docker lab. Not analyzed; metadata only.README.md:65
Review boundaries

What the analysis did not establish

  • Two binary plugin zip files (assets/truebooker-1.2.3.zip, assets/truebooker-1.2.6.zip) are present but not analyzed; their contents are not needed to classify the text-based exploit code.
  • The verification report references artifact files (e.g., artifacts/poc_run.txt) that are not included in the provided text evidence, but the report itself and the exploit code are sufficient for classification.
  • Two binary zip files (assets/truebooker-1.2.3.zip, assets/truebooker-1.2.6.zip) were flagged as BINARY and not analyzed. Their contents could theoretically contain unrelated malicious code, but the text-based PoC does not depend on executing them.
  • The review is limited to the supplied text evidence; no runtime behavior or network traffic was observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

3