CVE-2026-14364 is a critical vulnerability in the TrueBooker WordPress plugin that arises from improper validation during the password reset process. The plugin fails to verify the identity of users requesting password resets, enabling unauthenticated attackers to reset passwords for any user account, including those with administrative privileges. This vulnerability is classified under CWE-640 (Weak Password Recovery Mechanism) and affects all versions up to and including 1.2.3. The CVSS v3.1 base score is 9.8, reflecting its critical severity with network attack vector, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability.

An attacker can reset the password of any user account without authentication, including administrator accounts. This leads to complete account takeover, allowing unauthorized access to sensitive data, modification of site content or settings, and potential disruption of service. The vulnerability compromises confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the password reset functionality if possible and monitor for suspicious activity related to password resets. Avoid using affected versions in production environments where possible.