CVE-2026-14364 is a critical vulnerability in the TrueBooker – Appointment Booking and Scheduler System WordPress plugin (versions up to and including 1.2.3). The weakness lies in improper validation during the password reset process, classified under CWE-640 (Weak Password Recovery Mechanism). An attacker can exploit this by resetting passwords for any user account without authentication, including administrative accounts, leading to full account takeover. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to reset passwords for arbitrary user accounts, including administrators, resulting in complete account takeover. This compromises the confidentiality, integrity, and availability of the affected system and data managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the password reset functionality if possible, monitor for suspicious password reset activity, and consider disabling the plugin or replacing it with an alternative solution to prevent exploitation.