TrueBooker WordPress Plugin <=1.2.3 Vulnerable to Authorization Bypass
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- truebooker plugin (wordpress)
- Patched version
- Not yet available
The TrueBooker Appointment Booking and Scheduler System plugin for WordPress is under investigation for a critical vulnerability. This vulnerability, tracked as CVE-2026-14349, reportedly allows unauthenticated attackers to modify user account emails, including administrators, potentially leading to unauthorized access.
What happened
An early warning has been issued regarding a critical vulnerability in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress. This vulnerability, identified as CVE-2026-14349, is reported to affect all versions up to and including 1.2.3. The issue allows unauthenticated attackers to bypass authorization and modify the email addresses of arbitrary user accounts, including those of administrators. This can be exploited to reset account passwords and gain unauthorized access.
The vulnerability has a CVSS score of 9.8, indicating its critical severity. There are no reports of this vulnerability being exploited in the wild at this time. The attack does not appear to be part of a supply-chain attack. The issue was first flagged on September 16, 2026.
What to do about it
- Upgrade the TrueBooker plugin to a version beyond 1.2.3 if available.
- Monitor your WordPress site for any suspicious activities or unauthorized changes.
- Review user account activities and ensure that no unauthorized changes have been made.
- Consider implementing additional security measures such as two-factor authentication for administrator accounts.
- Stay updated with the latest information from the provided sources.
How 0Day would have caught this
truebooker plugin is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using the TrueBooker plugin for WordPress version 1.2.3 or earlier, you are reportedly affected by this vulnerability.
What should I do right now?
Immediately upgrade the TrueBooker plugin to a version beyond 1.2.3 if available. Monitor your site for any suspicious activities and review user account activities for unauthorized changes.
Is there an official fix available?
No official fix has been published yet. Monitor the sources below for updates on a patched version.