CVE-2026-14545 is an improper privilege management vulnerability (CWE-269) in the TrueBooker WordPress plugin prior to version 1.2.4. The plugin fails to validate account ownership during password reset requests handled via its front-end account handlers. This allows unauthenticated attackers to arbitrarily set passwords for any user account, including administrators, resulting in complete site takeover. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, no required privileges or user interaction, and impacts confidentiality, integrity, and availability.

Exploitation of this vulnerability allows an unauthenticated attacker to reset passwords for any user account on the affected WordPress site, including administrator accounts. This leads to full site compromise, enabling the attacker to gain complete control over the site, potentially resulting in data theft, site defacement, or further malicious activity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 1.2.4, upgrading to version 1.2.4 or later is recommended once the vendor releases an official fix. Until then, restrict access to the password reset functionality or disable the plugin if possible to mitigate risk.