What is CVE-2026-14364?
The TrueBooker WordPress plugin (≤1.2.3) is vulnerable to account takeover due to improper identity validation during password reset. Attackers can reset any user's password without proper verification. Immediate update to the latest version or temporary deactivation is strongly recommended.
Azərbaycanca: TrueBooker WordPress plaqini (≤1.2.3) parol sıfırlama validasiyasında zəiflik səbəbindən hesab ələ keçirməyə (account takeover) məruz qalır. İstifadəçi kimliyi düzgün yoxlanılmadığı üçün hücumçu istənilən hesabın parolunu dəyişə bilər. Plaqini dərhal ən son versiyaya yeniləmək və ya müvəqqəti olaraq deaktiv etmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-287
FAQ2
Which versions of the TrueBooker WordPress plugin are affected by CVE-2026-14364?
Versions 1.2.3 and earlier are affected by this vulnerability.
What security risk does CVE-2026-14364 pose?
It can lead to account takeover due to improper identity validation during the password reset process.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.