CVE-2026-14365

Name of the Vulnerable Software and Affected Versions TrueBooker – Appointment Booking and Scheduler System versions prior to 1.2.4

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This flaw allows unauthenticated attackers to change the password of any user account, including those with administrator privileges, potentially leading to full account takeover.

Recommendations Update the plugin to a version later than 1.2.3.